theory Retype_C

lemma cnc_tcb_helper:
  fixes p :: "tcb_C ptr"
  defines "kotcb \<equiv> (KOTCB (makeObject :: tcb))"
  assumes rfsr: "(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> rf_sr"
  and      al: "is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)"
  and ptr0: "ctcb_ptr_to_tcb_ptr p \<noteq> 0"
  and ptrlb: "2^ctcb_size_bits \<le> ptr_val p"
  and vq:  "valid_queues \<sigma>"
  and pal: "pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)"
  and pno: "pspace_no_overlap' (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (\<sigma>\<lparr>ksPSpace := ks\<rparr>)"
  and pds: "pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)"
  and symref: "sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>))"
  and kssub: "dom (ksPSpace \<sigma>) \<subseteq> dom ks"
  and rzo: "ret_zero (ctcb_ptr_to_tcb_ptr p) (2 ^ objBitsKO kotcb) \<sigma>"
  and empty: "region_is_bytes (ctcb_ptr_to_tcb_ptr p) (2 ^ tcbBlockSizeBits) x"
  and rep0:  "heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p) = replicate (2 ^ tcbBlockSizeBits) 0"
  and kdr: "{ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}"
  shows "(\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>,
     globals_update
      (t_hrs_'_update
        (\<lambda>a. hrs_mem_update (heap_update (Ptr &(p\<rightarrow>[''tcbTimeSlice_C'']) :: machine_word ptr) (5 :: machine_word))
              (hrs_mem_update
                (heap_update ((Ptr &((Ptr &((Ptr &(p\<rightarrow>[''tcbArch_C'']) :: arch_tcb_C ptr)\<rightarrow>[''tcbContext_C''])
                     :: user_context_C ptr)\<rightarrow>[''registers_C''])) :: (word32[20]) ptr)
                  (Arrays.update (h_val (hrs_mem a) ((Ptr &((Ptr &((Ptr &(p\<rightarrow>[''tcbArch_C'']) :: arch_tcb_C ptr)\<rightarrow>[''tcbContext_C''])
                       :: user_context_C ptr)\<rightarrow>[''registers_C''])) :: (word32[20]) ptr)) (unat Kernel_C.CPSR) (0x150 :: word32)))
                   (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (Ptr (ctcb_ptr_to_tcb_ptr p) :: (cte_C[5]) ptr) False
                       (ptr_retyps_gen 1 p False xa)) a)))) x)
             \<in> rf_sr"
  (is "(\<sigma>\<lparr>ksPSpace := ?ks\<rparr>, globals_update ?gs' x) \<in> rf_sr") proof - define ko where "ko \<equiv> (KOCTE (makeObject :: cte))" let ?ptr = "cte_Ptr (ctcb_ptr_to_tcb_ptr p)" let ?arr_ptr = "Ptr (ctcb_ptr_to_tcb_ptr p) :: (cte_C[5]) ptr" let ?sp = "\<sigma>\<lparr>ksPSpace := ks\<rparr>" let ?s = "\<sigma>\<lparr>ksPSpace := ?ks\<rparr>" let ?gs = "?gs' (globals x)" let ?hp = "(fst (t_hrs_' ?gs), (ptr_retyps_gen 1 p False (snd (t_hrs_' (globals x)))))" note tcb_C_size[simp del] from al have cover: "range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)
        (objBitsKO kotcb) (Suc 0)" by (rule range_cover_full, simp_all add: al) have "\<forall>n<2 ^ (objBitsKO kotcb - objBitsKO ko). c_guard (CTypesDefs.ptr_add ?ptr (of_nat n))" apply (rule retype_guard_helper [where m = 2]) apply (rule range_cover_rel[OF cover, rotated]) apply simp apply (simp add: ko_def objBits_simps' kotcb_def) apply (rule ptr0) apply (simp add: ko_def objBits_simps' size_of_def) apply (simp add: ko_def objBits_simps') apply (simp add: ko_def objBits_simps align_of_def) done hence guard: "\<forall>n<5. c_guard (CTypesDefs.ptr_add ?ptr (of_nat n))" by (simp add: ko_def kotcb_def objBits_simps' align_of_def) have arr_guard: "c_guard ?arr_ptr" apply (rule is_aligned_c_guard[where m=2], simp, rule al) apply (simp add: ptr0) apply (simp add: align_of_def align_td_array) apply (simp add: cte_C_size objBits_simps' kotcb_def) apply (simp add: kotcb_def objBits_simps') done have heap_update_to_hrs_mem_update:
    "\<And>p x hp ht. (heap_update p x hp, ht) = hrs_mem_update (heap_update p x) (hp, ht)" by (simp add: hrs_mem_update_def split_def) have empty_smaller:
    "region_is_bytes (ptr_val p) (size_of TYPE(tcb_C)) x"
    "region_is_bytes' (ctcb_ptr_to_tcb_ptr p) (5 * size_of TYPE(cte_C))
        (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x))))" using al region_is_bytes_subset[OF empty] tcb_ptr_to_ctcb_ptr_in_range' apply (simp add: objBits_simps kotcb_def) apply (clarsimp simp: region_is_bytes'_def) apply (subst(asm) ptr_retyps_gen_out) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs intvl_def) apply (simp add: unat_arith_simps unat_of_nat cte_C_size tcb_C_size
               split: if_split_asm) apply (subst(asm) empty[unfolded region_is_bytes'_def], simp_all) apply (erule subsetD[rotated], rule intvl_start_le) apply (simp add: cte_C_size objBits_defs) done note htd[simp] = hrs_htd_update_htd_update[unfolded o_def,
        where d="ptr_retyps_gen n p a" and d'="ptr_retyps_gen n' p' a'"
        for n p a n' p' a', symmetric] have cgp: "c_guard p" using al apply - apply (rule c_guard_tcb [OF _ ptr0]) apply (simp add: kotcb_def objBits_simps) done have "ptr_val p = ctcb_ptr_to_tcb_ptr p + ctcb_offset" by (simp add: ctcb_ptr_to_tcb_ptr_def) have cl_cte: "(cslift (x\<lparr>globals := ?gs\<rparr>) :: cte_C typ_heap) =
    (\<lambda>y. if y \<in> (CTypesDefs.ptr_add (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ>
                 of_nat) `
                {k. k < 5}
         then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y)" using cgp apply (simp add: ptr_retyp_to_array[simplified] hrs_comm[symmetric]) apply (subst clift_ptr_retyps_gen_prev_memset_same[OF guard],
           simp_all add: hrs_htd_update empty_smaller[simplified]) apply (simp add: cte_C_size word_bits_def) apply (simp add: hrs_mem_update typ_heap_simps
                      packed_heap_update_collapse) apply (simp add: heap_update_def) apply (subst heap_list_update_disjoint_same) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs intvl_def
                            set_eq_iff) apply (simp add: unat_arith_simps unat_of_nat cte_C_size tcb_C_size) apply (subst take_heap_list_le[symmetric]) prefer 2 apply (simp add: hrs_mem_def, subst rep0) apply (simp only: take_replicate, simp add: cte_C_size objBits_defs) apply (simp add: cte_C_size objBits_defs) apply (simp add: fun_eq_iff
              split: if_split) apply (simp add: hrs_comm packed_heap_update_collapse
                     typ_heap_simps) apply (subst clift_heap_update_same_td_name, simp_all,
      simp add: hrs_htd_update ptr_retyps_gen_def ptr_retyp_h_t_valid)+ apply (subst clift_ptr_retyps_gen_other,
      simp_all add: empty_smaller tag_disj_via_td_name) apply (simp add: tcb_C_size word_bits_def) done have tcb0: "heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0" proof - have "heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p)
      = take (size_of TYPE(tcb_C))
             (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p))
                   (heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p)))" by (simp add: drop_heap_list_le take_heap_list_le size_of_def ctcb_ptr_to_tcb_ptr_def
                    ctcb_offset_defs objBits_defs) also have "\<dots> = replicate (size_of TYPE(tcb_C)) 0" apply (subst rep0) apply (simp only: take_replicate drop_replicate) apply (rule arg_cong [where f = "\<lambda>x. replicate x 0"]) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs size_of_def objBits_defs) done finally show "heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0" . qed let ?new_tcb =  "(from_bytes (replicate (size_of TYPE(tcb_C)) 0)
                  \<lparr>tcbArch_C := tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))
                    \<lparr>tcbContext_C := tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))
                     \<lparr>registers_C :=
                        Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR)
                         0x150\<rparr>\<rparr>, tcbTimeSlice_C := 5\<rparr>)" have "ptr_retyp p (snd (t_hrs_' (globals x))) \<Turnstile>\<^sub>t p" using cgp by (rule ptr_retyp_h_t_valid) hence "clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p
    = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0))" by (simp add: lift_t_if h_val_def tcb0 hrs_mem_def) hence cl_tcb: "(cslift (x\<lparr>globals := ?gs\<rparr>) :: tcb_C typ_heap) = (cslift x)(p \<mapsto> ?new_tcb)" using cgp apply (clarsimp simp add: typ_heap_simps
                              hrs_mem_update packed_heap_update_collapse_hrs) apply (simp add: hrs_comm[symmetric]) apply (subst clift_ptr_retyps_gen_other, simp_all add: hrs_htd_update
      empty_smaller[simplified] tag_disj_via_td_name) apply (simp add: cte_C_size word_bits_def) apply (simp add: hrs_comm typ_heap_simps ptr_retyps_gen_def
                     hrs_htd_update ptr_retyp_h_t_valid
                     h_val_heap_update) apply (simp add: h_val_field_from_bytes) apply (simp add: h_val_def tcb0[folded hrs_mem_def]) apply (rule ext, rename_tac p') apply (case_tac "p' = p", simp_all) apply (cut_tac clift_ptr_retyps_gen_prev_memset_same[where n=1 and arr=False, simplified,
      OF _ empty_smaller(1) _ refl], simp_all add: tcb0[folded hrs_mem_def]) apply (simp add: ptr_retyps_gen_def) apply (simp add: tcb_C_size word_bits_def) done have cl_rest:
    "\<lbrakk>typ_uinfo_t TYPE(tcb_C) \<bottom>\<^sub>t typ_uinfo_t TYPE('a :: mem_type);
      typ_uinfo_t TYPE(cte_C[5]) \<bottom>\<^sub>t typ_uinfo_t TYPE('a :: mem_type);
      typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(word8) \<rbrakk> \<Longrightarrow>
    cslift (x\<lparr>globals := ?gs\<rparr>) = (cslift x :: 'a :: mem_type typ_heap)" using cgp apply (clarsimp simp: hrs_comm[symmetric]) apply (subst clift_ptr_retyps_gen_other,
      simp_all add: hrs_htd_update empty_smaller[simplified],
      simp_all add: cte_C_size tcb_C_size word_bits_def) apply (simp add: hrs_comm ptr_retyps_gen_def) apply (simp add: clift_heap_update_same hrs_htd_update ptr_retyp_h_t_valid typ_heap_simps) apply (rule trans[OF _ clift_ptr_retyps_gen_other[where nptrs=1 and arr=False,
        simplified, OF empty_smaller(1)]], simp_all) apply (simp add: ptr_retyps_gen_def) apply (simp add: tcb_C_size word_bits_def) done have rl:
    "(\<forall>v :: 'a :: pre_storable. projectKO_opt kotcb \<noteq> Some v) \<Longrightarrow>
    (projectKO_opt \<circ>\<^sub>m (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) :: word32 \<Rightarrow> 'a option)
    = projectKO_opt \<circ>\<^sub>m ks" using pno al apply - apply (drule(2) projectKO_opt_retyp_other'[OF _ _ pal]) apply (simp add: kotcb_def) done have rl_tcb: "(projectKO_opt \<circ>\<^sub>m (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) :: word32 \<Rightarrow> tcb option)
    = (projectKO_opt \<circ>\<^sub>m ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)" apply (rule ext) apply (clarsimp simp: projectKOs map_comp_def split: if_split) done have mko: "\<And>dev. makeObjectKO dev (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Some kotcb" by (simp add: makeObjectKO_def kotcb_def) note hacky_cte = retype_ctes_helper [where sz = "objBitsKO kotcb" and ko = kotcb and ptr = "ctcb_ptr_to_tcb_ptr p",
    OF pal pds pno al _ _ mko, simplified new_cap_addrs_def, simplified]

  \<comment> \<open>Ugh\<close> moreover have
    "\<And>y. y \<in> ptr_val ` (CTypesDefs.ptr_add (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> of_nat) ` {k. k < 5}
      = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases)"
    (is "\<And>y. ?LHS y = ?RHS y") proof - fix y have al_rl: "\<And>k. k < 5 \<Longrightarrow>
      ctcb_ptr_to_tcb_ptr p + of_nat k * of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits = of_nat k * of_nat (size_of TYPE(cte_C))
      \<and> ctcb_ptr_to_tcb_ptr p + of_nat k * of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p" using al apply - apply (rule is_aligned_add_helper) apply (simp add: objBits_simps kotcb_def) apply (subst Abs_fnat_hom_mult) apply (subst word_less_nat_alt) apply (subst unat_of_nat32) apply (simp add: size_of_def word_bits_conv objBits_defs)+ done have al_rl2: "\<And>k. k < 5 \<Longrightarrow> unat (of_nat k * of_nat (size_of TYPE(cte_C)) :: word32) = k * 2^cteSizeBits" apply (subst Abs_fnat_hom_mult) apply (subst unat_of_nat32) apply (simp add: size_of_def word_bits_conv objBits_defs)+ done show "?LHS y = ?RHS y" using al apply (simp add: image_image kotcb_def objBits_simps) apply rule apply (clarsimp simp: dom_tcb_cte_cases_iff al_rl al_rl2) apply (simp add: objBits_defs) apply (clarsimp simp: dom_tcb_cte_cases_iff al_rl al_rl2) apply (rule_tac x = ya in image_eqI) apply (rule mask_eqI [where n = tcbBlockSizeBits]) apply (subst unat_arith_simps(3)) apply (simp add: al_rl al_rl2, simp add: objBits_defs)+ done qed ultimately have rl_cte: "(map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) :: word32 \<Rightarrow> cte option)
    = (\<lambda>x. if x \<in> ptr_val ` (CTypesDefs.ptr_add (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> of_nat) ` {k. k < 5}
         then Some (CTE NullCap nullMDBNode)
         else map_to_ctes ks x)" apply simp apply (drule_tac x = "Suc 0" in meta_spec) apply clarsimp apply (erule impE[OF impI]) apply (rule range_cover_full[OF al]) apply (simp add: objBits_simps' word_bits_conv pageBits_def archObjSize_def pdeBits_def pteBits_def
       split:kernel_object.splits arch_kernel_object.splits) apply (simp add: fun_upd_def kotcb_def cong: if_cong) done let ?tcb = "undefined
    \<lparr>tcbArch_C := tcbArch_C undefined
     \<lparr>tcbContext_C := tcbContext_C (tcbArch_C undefined)
       \<lparr>registers_C :=
          foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20]
           (registers_C (tcbContext_C (tcbArch_C undefined)))\<rparr>\<rparr>,
       tcbState_C :=
         thread_state_C.words_C_update
          (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3]
                (thread_state_C.words_C (tcbState_C undefined)))
          (tcbState_C undefined),
       tcbFault_C :=
         seL4_Fault_C.words_C_update
          (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2]
                (seL4_Fault_C.words_C (tcbFault_C undefined)))
          (tcbFault_C undefined),
       tcbLookupFailure_C :=
         lookup_fault_C.words_C_update
          (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2]
                (lookup_fault_C.words_C (tcbLookupFailure_C undefined)))
          (tcbLookupFailure_C undefined),
       tcbPriority_C := 0, tcbMCP_C := 0, tcbDomain_C := 0, tcbTimeSlice_C := 0,
       tcbFaultHandler_C := 0, tcbIPCBuffer_C := 0,
       tcbSchedNext_C := tcb_Ptr 0, tcbSchedPrev_C := tcb_Ptr 0,
       tcbEPNext_C := tcb_Ptr 0, tcbEPPrev_C := tcb_Ptr 0,
       tcbBoundNotification_C := ntfn_Ptr 0\<rparr>" have fbtcb: "from_bytes (replicate (size_of TYPE(tcb_C)) 0) = ?tcb" apply (simp add: from_bytes_def) apply (simp add: typ_info_simps tcb_C_tag_def) apply (simp add: ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td align_of_def padup_def
      final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def) (* takes ages *)
     apply (simp add: update_ti_adjust_ti update_ti_t_word32_0s
      typ_info_simps
      user_context_C_tag_def thread_state_C_tag_def seL4_Fault_C_tag_def
      lookup_fault_C_tag_def update_ti_t_ptr_0s arch_tcb_C_tag_def
      ti_typ_pad_combine_empty_ti ti_typ_pad_combine_td
      align_of_def padup_def
      final_pad_def size_td_lt_ti_typ_pad_combine Let_def size_of_def
      align_td_array' size_td_array) apply (simp add: update_ti_t_array_rep_word0) done have tcb_rel:
    "ctcb_relation makeObject ?new_tcb" unfolding ctcb_relation_def makeObject_tcb apply (simp add: fbtcb minBound_word) apply (intro conjI) apply (simp add: cthread_state_relation_def thread_state_lift_def
                     eval_nat_numeral ThreadState_Inactive_def) apply (simp add: ccontext_relation_def carch_tcb_relation_def) apply (rule allI) subgoal for r by (case_tac r;
          simp add: "StrictC'_register_defs" eval_nat_numeral atcbContext_def atcbContextGet_def
                    newArchTCB_def newContext_def initContext_def take_bit_Suc
               del: unsigned_numeral) apply (simp add: thread_state_lift_def eval_nat_numeral atcbContextGet_def)+ apply (simp add: Kernel_Config.timeSlice_def) apply (simp add: cfault_rel_def seL4_Fault_lift_def seL4_Fault_get_tag_def Let_def
                     lookup_fault_lift_def lookup_fault_get_tag_def lookup_fault_invalid_root_def
                     eval_nat_numeral seL4_Fault_NullFault_def option_to_ptr_def option_to_0_def
                split: if_split)+ done have pks: "ks (ctcb_ptr_to_tcb_ptr p) = None" by (rule pspace_no_overlap_base' [OF pal pno al, simplified]) have ep1 [simplified]: "\<And>p' list. map_to_eps (ksPSpace ?sp) p' = Some (Structures_H.endpoint.RecvEP list)
       \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list" using symref pks pal pds apply - apply (frule map_to_ko_atI) apply simp apply simp apply (drule (1) sym_refs_ko_atD') apply clarsimp apply (drule (1) bspec) apply (simp add: ko_wp_at'_def) done have ep2 [simplified]: "\<And>p' list. map_to_eps (ksPSpace ?sp) p' = Some (Structures_H.endpoint.SendEP list)
       \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list" using symref pks pal pds apply - apply (frule map_to_ko_atI) apply simp apply simp apply (drule (1) sym_refs_ko_atD') apply clarsimp apply (drule (1) bspec) apply (simp add: ko_wp_at'_def) done have ep3 [simplified]: "\<And>p' list boundTCB. map_to_ntfns (ksPSpace ?sp) p' = Some (Structures_H.notification.NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB)
       \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list" using symref pks pal pds apply - apply (frule map_to_ko_atI) apply simp apply simp apply (drule (1) sym_refs_ko_atD') apply clarsimp apply (drule_tac x="(ctcb_ptr_to_tcb_ptr p, NTFNSignal)" in bspec, simp) apply (simp add: ko_wp_at'_def) done have pks': "ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None" using pks kssub apply - apply (erule contrapos_pp) apply (fastforce simp: dom_def) done hence kstcb: "\<And>qdom prio. ctcb_ptr_to_tcb_ptr p \<notin> set (ksReadyQueues \<sigma> (qdom, prio))" using vq apply (clarsimp simp add: valid_queues_def valid_queues_no_bitmap_def) apply (drule_tac x = qdom in spec) apply (drule_tac x = prio in spec) apply clarsimp apply (drule (1) bspec) apply (simp add: obj_at'_def) done have ball_subsetE:
    "\<And>P S R. \<lbrakk> \<forall>x \<in> S. P x; R \<subseteq> S \<rbrakk> \<Longrightarrow> \<forall>x \<in> R. P x" by blast have domain_kdr:
    "-domain \<subseteq> kernel_data_refs" using rfsr unfolding rf_sr_def cstate_relation_def Let_def by simp have htd_safe:
    "htd_safe domain (hrs_htd (t_hrs_' (globals x)))
        \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' ?gs))" using kdr apply (simp add: hrs_htd_update) apply (intro ptr_retyps_htd_safe_neg[OF _ _ domain_kdr], simp_all) apply (erule disjoint_subset[rotated]) apply (simp add: ctcb_ptr_to_tcb_ptr_def size_of_def) apply (rule intvl_sub_offset[where k="ptr_val p - ctcb_offset" and x="ctcb_offset", simplified]) apply (simp add: ctcb_offset_defs objBits_defs) apply (erule disjoint_subset[rotated]) apply (rule intvl_start_le) apply (simp add: size_of_def objBits_defs) done have zro:
    "zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x))" using rfsr by (clarsimp simp: rf_sr_def cstate_relation_def Let_def) have h_t_valid_p:
    "h_t_valid (hrs_htd (t_hrs_' ?gs)) c_guard p" using fun_cong[OF cl_tcb, where x=p] by (clarsimp dest!: h_t_valid_clift) have zro':
    "zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' ?gs)" using zro h_t_valid_p rzo al apply clarsimp apply (simp add: hrs_htd_update typ_heap_simps') apply (intro zero_ranges_ptr_retyps, simp_all) apply (erule caps_overlap_reserved'_subseteq) apply (rule order_trans, rule tcb_ptr_to_ctcb_ptr_in_range') apply (simp add: objBits_simps kotcb_def) apply (simp add: objBits_simps kotcb_def) apply (erule caps_overlap_reserved'_subseteq) apply (rule intvl_start_le) apply (simp add: cte_C_size kotcb_def objBits_simps') done note ht_rest = clift_eq_h_t_valid_eq[OF cl_rest, simplified] note irq = h_t_valid_eq_array_valid[where p=intStateIRQNode_array_Ptr]
    h_t_array_valid_ptr_retyps_gen[where n=1, simplified, OF refl empty_smaller(1)]
    h_t_array_valid_ptr_retyps_gen[where p="Ptr x" for x, simplified, OF refl empty_smaller(2)] from rfsr have "cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x))" unfolding rf_sr_def cstate_relation_def by (simp add: Let_def) hence "cpspace_relation ?ks (underlying_memory (ksMachineState \<sigma>))  (t_hrs_' ?gs)" unfolding cpspace_relation_def apply - apply (simp add: cl_cte [simplified] cl_tcb [simplified] cl_rest [simplified] tag_disj_via_td_name
                     ht_rest) apply (simp add: rl kotcb_def projectKOs rl_tcb rl_cte) apply (elim conjE) apply (intro conjI)
     \<comment> \<open>cte\<close> apply (erule cmap_relation_retype2) apply (simp add:ccte_relation_nullCap nullMDBNode_def nullPointer_def)
    \<comment> \<open>tcb\<close> apply (erule cmap_relation_updI2 [where dest = "ctcb_ptr_to_tcb_ptr p" and f = "tcb_ptr_to_ctcb_ptr", simplified]) apply (rule map_comp_simps) apply (rule pks) apply (rule tcb_rel)
    \<comment> \<open>ep\<close> apply (erule iffD2 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply (simp add: cendpoint_relation_def Let_def) apply (subst endpoint.case_cong) apply (rule refl) apply (simp add: tcb_queue_update_other' ep1) apply (simp add: tcb_queue_update_other' del: tcb_queue_relation'_empty) apply (simp add: tcb_queue_update_other' ep2) apply clarsimp
  \<comment> \<open>ntfn\<close> apply (erule iffD2 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply (simp add: cnotification_relation_def Let_def) apply (subst ntfn.case_cong) apply (rule refl) apply (simp add: tcb_queue_update_other' del: tcb_queue_relation'_empty) apply (simp add: tcb_queue_update_other' del: tcb_queue_relation'_empty) apply (case_tac a, simp add: tcb_queue_update_other' ep3) apply (clarsimp simp: typ_heap_simps) done moreover have "cte_array_relation \<sigma> ?gs
    \<and> tcb_cte_array_relation ?s ?gs" using rfsr apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                          hrs_htd_update map_comp_update
                          kotcb_def projectKO_opt_tcb) apply (intro cvariable_array_ptr_upd conjI
                 cvariable_array_ptr_retyps[OF refl, where n=1, simplified],
           simp_all add: empty_smaller[simplified]) apply (simp add: ptr_retyps_gen_def) apply (rule ptr_retyp_h_t_valid[where g=c_guard, OF arr_guard,
        THEN h_t_array_valid, simplified]) done ultimately show ?thesis using rfsr zro' apply (simp add: rf_sr_def cstate_relation_def Let_def h_t_valid_clift_Some_iff
      tag_disj_via_td_name carch_state_relation_def cmachine_state_relation_def irq) apply (simp add: cl_cte [simplified] cl_tcb [simplified] cl_rest [simplified] tag_disj_via_td_name) apply (clarsimp simp add: cready_queues_relation_def Let_def
                              htd_safe[simplified] kernel_data_refs_domain_eq_rotate) apply (simp add: kstcb tcb_queue_update_other' hrs_htd_update
                     ptr_retyp_to_array[simplified] irq[simplified]) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
ko \<equiv> KOCTE makeObject

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
size_of TYPE(tcb_C) \<equiv> 152

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (chain)
picking this:
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) proof (prove)
using this:
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)

goal (1 subgoal):
 1. range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) (Suc 0) proof (state)
this:
range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) (Suc 0)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<forall>n<2 ^ (objBitsKO kotcb - objBitsKO ko). c_guard (cte_Ptr (ctcb_ptr_to_tcb_ptr p) +\<^sub>p int n) proof (prove)
goal (5 subgoals):
 1. range_cover (ctcb_ptr_to_tcb_ptr p) ?sz (objBitsKO ?ko) (2 ^ (objBitsKO kotcb - objBitsKO ko))
 2. ctcb_ptr_to_tcb_ptr p \<noteq> 0
 3. size_of TYPE(cte_C) = 2 ^ objBitsKO ?ko
 4. 2 \<le> objBitsKO ?ko
 5. align_of TYPE(cte_C) = 2\<^sup>2 proof (prove)
goal (6 subgoals):
 1. 2 ^ (objBitsKO kotcb - objBitsKO ko) = 2 ^ (objBitsKO kotcb - objBitsKO ?ko) * Suc 0
 2. objBitsKO ?ko \<le> objBitsKO kotcb
 3. ctcb_ptr_to_tcb_ptr p \<noteq> 0
 4. size_of TYPE(cte_C) = 2 ^ objBitsKO ?ko
 5. 2 \<le> objBitsKO ?ko
 6. align_of TYPE(cte_C) = 2\<^sup>2 proof (prove)
goal (5 subgoals):
 1. objBitsKO ko \<le> objBitsKO kotcb
 2. ctcb_ptr_to_tcb_ptr p \<noteq> 0
 3. size_of TYPE(cte_C) = 2 ^ objBitsKO ko
 4. 2 \<le> objBitsKO ko
 5. align_of TYPE(cte_C) = 2\<^sup>2 proof (prove)
goal (4 subgoals):
 1. ctcb_ptr_to_tcb_ptr p \<noteq> 0
 2. size_of TYPE(cte_C) = 2 ^ objBitsKO ko
 3. 2 \<le> objBitsKO ko
 4. align_of TYPE(cte_C) = 2\<^sup>2 proof (prove)
goal (3 subgoals):
 1. size_of TYPE(cte_C) = 2 ^ objBitsKO ko
 2. 2 \<le> objBitsKO ko
 3. align_of TYPE(cte_C) = 2\<^sup>2 proof (prove)
goal (2 subgoals):
 1. 2 \<le> objBitsKO ko
 2. align_of TYPE(cte_C) = 2\<^sup>2 proof (prove)
goal (1 subgoal):
 1. align_of TYPE(cte_C) = 2\<^sup>2 proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>n<2 ^ (objBitsKO kotcb - objBitsKO ko). c_guard (cte_Ptr (ctcb_ptr_to_tcb_ptr p) +\<^sub>p int n)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
using this:
\<forall>n<2 ^ (objBitsKO kotcb - objBitsKO ko). c_guard (cte_Ptr (ctcb_ptr_to_tcb_ptr p) +\<^sub>p int n)

goal (1 subgoal):
 1. \<forall>n<5. c_guard (cte_Ptr (ctcb_ptr_to_tcb_ptr p) +\<^sub>p int n) proof (state)
this:
\<forall>n<5. c_guard (cte_Ptr (ctcb_ptr_to_tcb_ptr p) +\<^sub>p int n)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. c_guard (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) proof (prove)
goal (4 subgoals):
 1. ptr_val (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) \<noteq> 0
 2. align_of TYPE(cte_C[5]) = 2\<^sup>2
 3. size_of TYPE(cte_C[5]) \<le> 2 ^ objBitsKO kotcb
 4. 2 \<le> objBitsKO kotcb proof (prove)
goal (3 subgoals):
 1. align_of TYPE(cte_C[5]) = 2\<^sup>2
 2. size_of TYPE(cte_C[5]) \<le> 2 ^ objBitsKO kotcb
 3. 2 \<le> objBitsKO kotcb proof (prove)
goal (2 subgoals):
 1. size_of TYPE(cte_C[5]) \<le> 2 ^ objBitsKO kotcb
 2. 2 \<le> objBitsKO kotcb proof (prove)
goal (1 subgoal):
 1. 2 \<le> objBitsKO kotcb proof (prove)
goal:
No subgoals! proof (state)
this:
c_guard (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>p x hp ht. (heap_update p x hp, ht) = hrs_mem_update (heap_update p x) (hp, ht) proof (state)
this:
(heap_update ?p2 ?x2 ?hp2, ?ht2) = hrs_mem_update (heap_update ?p2 ?x2) (?hp2, ?ht2)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. region_is_bytes (ptr_val p) (size_of TYPE(tcb_C)) x &&& region_is_bytes' (ctcb_ptr_to_tcb_ptr p) (5 * size_of TYPE(cte_C)) (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x)))) proof (prove)
using this:
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)
{?ptr'..+?sz'} \<subseteq> {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<Longrightarrow> region_is_bytes ?ptr' ?sz' x
is_aligned (ctcb_ptr_to_tcb_ptr ?x) tcbBlockSizeBits \<Longrightarrow> ptr_span ?x \<subseteq> {ctcb_ptr_to_tcb_ptr ?x..+2 ^ objBits ?tcb}

goal (1 subgoal):
 1. region_is_bytes (ptr_val p) (size_of TYPE(tcb_C)) x &&& region_is_bytes' (ctcb_ptr_to_tcb_ptr p) (5 * size_of TYPE(cte_C)) (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x)))) proof (prove)
goal (1 subgoal):
 1. region_is_bytes' (ctcb_ptr_to_tcb_ptr p) (5 * size_of TYPE(cte_C)) (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x)))) proof (prove)
goal (1 subgoal):
 1. \<And>z td n b. \<lbrakk>z \<in> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)}; td \<noteq> typ_uinfo_t TYPE(8 word); snd (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x))) z) n = Some (td, b)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z td n b. \<lbrakk>z \<in> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)}; td \<noteq> typ_uinfo_t TYPE(8 word)\<rbrakk> \<Longrightarrow> z \<notin> {ptr_val p..+Suc 0 * size_of TYPE(tcb_C)}
 2. \<And>z td n b. \<lbrakk>z \<in> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)}; td \<noteq> typ_uinfo_t TYPE(8 word); snd (hrs_htd (t_hrs_' (globals x)) z) n = Some (td, b)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>td k ka. \<lbrakk>td \<noteq> typ_uinfo_t TYPE(8 word); k < 5 * size_of TYPE(cte_C); 0xFFFFFF00 + word_of_nat k = word_of_nat ka; ka < size_of TYPE(tcb_C)\<rbrakk> \<Longrightarrow> False
 2. \<And>z td n b. \<lbrakk>z \<in> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)}; td \<noteq> typ_uinfo_t TYPE(8 word); snd (hrs_htd (t_hrs_' (globals x)) z) n = Some (td, b)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z td n b. \<lbrakk>z \<in> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)}; td \<noteq> typ_uinfo_t TYPE(8 word); snd (hrs_htd (t_hrs_' (globals x)) z) n = Some (td, b)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z td. \<lbrakk>z \<in> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)}; td \<noteq> typ_uinfo_t TYPE(8 word)\<rbrakk> \<Longrightarrow> z \<in> {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} proof (prove)
goal (1 subgoal):
 1. \<And>z td. td \<noteq> typ_uinfo_t TYPE(8 word) \<Longrightarrow> 5 * size_of TYPE(cte_C) \<le> 2 ^ tcbBlockSizeBits proof (prove)
goal:
No subgoals! proof (state)
this:
region_is_bytes (ptr_val p) (size_of TYPE(tcb_C)) x
region_is_bytes' (ctcb_ptr_to_tcb_ptr p) (5 * size_of TYPE(cte_C)) (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x))))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
hrs_htd_update (\<lambda>x. ptr_retyps_gen ?n ?pa ?a (ptr_retyps_gen ?n' ?p' ?a' x)) = (\<lambda>s. hrs_htd_update (ptr_retyps_gen ?n ?pa ?a) (hrs_htd_update (ptr_retyps_gen ?n' ?p' ?a') s))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. c_guard p proof (prove)
using this:
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)

goal (1 subgoal):
 1. c_guard p proof (prove)
goal (1 subgoal):
 1. is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) \<Longrightarrow> c_guard p proof (prove)
goal (1 subgoal):
 1. is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) \<Longrightarrow> is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits proof (prove)
goal:
No subgoals! proof (state)
this:
c_guard p

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. ptr_val p = ctcb_ptr_to_tcb_ptr p + ctcb_offset proof (state)
this:
ptr_val p = ctcb_ptr_to_tcb_ptr p + ctcb_offset

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = (\<lambda>y. if y \<in> ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
using this:
c_guard p

goal (1 subgoal):
 1. cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = (\<lambda>y. if y \<in> ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (1 subgoal):
 1. c_guard p \<Longrightarrow> clift (hrs_htd_update (ptr_retyps_gen 5 (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) True) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x)))))) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (3 subgoals):
 1. c_guard p \<Longrightarrow> 5 * size_of TYPE(cte_C) < 2 ^ word_bits
 2. c_guard p \<Longrightarrow> heap_list (hrs_mem (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) (5 * size_of TYPE(cte_C)) (ctcb_ptr_to_tcb_ptr p) = replicate (5 * size_of TYPE(cte_C)) 0
 3. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (2 subgoals):
 1. c_guard p \<Longrightarrow> heap_list (hrs_mem (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) (5 * size_of TYPE(cte_C)) (ctcb_ptr_to_tcb_ptr p) = replicate (5 * size_of TYPE(cte_C)) 0
 2. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (2 subgoals):
 1. c_guard p \<Longrightarrow> heap_list (heap_update p (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (heap_update p (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p)) (hrs_mem (t_hrs_' (globals x)))) p)) (hrs_mem (t_hrs_' (globals x)))) (5 * size_of TYPE(cte_C)) (ctcb_ptr_to_tcb_ptr p) = replicate (5 * size_of TYPE(cte_C)) 0
 2. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (2 subgoals):
 1. c_guard p \<Longrightarrow> heap_list (heap_update_list (ptr_val p) (to_bytes (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (heap_update_list (ptr_val p) (to_bytes (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p)) (heap_list (hrs_mem (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p))) (hrs_mem (t_hrs_' (globals x)))) p)) (heap_list (hrs_mem (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p))) (hrs_mem (t_hrs_' (globals x)))) (5 * size_of TYPE(cte_C)) (ctcb_ptr_to_tcb_ptr p) = replicate (5 * size_of TYPE(cte_C)) 0
 2. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (3 subgoals):
 1. c_guard p \<Longrightarrow> {ptr_val p..+length (to_bytes (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (heap_update_list (ptr_val p) (to_bytes (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p)) (heap_list (hrs_mem (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p))) (hrs_mem (t_hrs_' (globals x)))) p)) (heap_list (hrs_mem (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p)))} \<inter> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} = {}
 2. c_guard p \<Longrightarrow> heap_list (hrs_mem (t_hrs_' (globals x))) (5 * size_of TYPE(cte_C)) (ctcb_ptr_to_tcb_ptr p) = replicate (5 * size_of TYPE(cte_C)) 0
 3. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (3 subgoals):
 1. \<And>k ka. \<lbrakk>c_guard p; 0xFFFFFF00 + word_of_nat k = word_of_nat ka; k < 5 * size_of TYPE(cte_C); ka < size_of TYPE(tcb_C)\<rbrakk> \<Longrightarrow> False
 2. c_guard p \<Longrightarrow> heap_list (hrs_mem (t_hrs_' (globals x))) (5 * size_of TYPE(cte_C)) (ctcb_ptr_to_tcb_ptr p) = replicate (5 * size_of TYPE(cte_C)) 0
 3. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (2 subgoals):
 1. c_guard p \<Longrightarrow> heap_list (hrs_mem (t_hrs_' (globals x))) (5 * size_of TYPE(cte_C)) (ctcb_ptr_to_tcb_ptr p) = replicate (5 * size_of TYPE(cte_C)) 0
 2. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (3 subgoals):
 1. c_guard p \<Longrightarrow> 5 * size_of TYPE(cte_C) \<le> ?n69
 2. c_guard p \<Longrightarrow> take (5 * size_of TYPE(cte_C)) (heap_list (hrs_mem (t_hrs_' (globals x))) ?n69 (ctcb_ptr_to_tcb_ptr p)) = replicate (5 * size_of TYPE(cte_C)) 0
 3. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (3 subgoals):
 1. c_guard p \<Longrightarrow> take (5 * size_of TYPE(cte_C)) (heap_list (hrs_mem (t_hrs_' (globals x))) ?n69 (ctcb_ptr_to_tcb_ptr p)) = replicate (5 * size_of TYPE(cte_C)) 0
 2. c_guard p \<Longrightarrow> 5 * size_of TYPE(cte_C) \<le> ?n69
 3. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (3 subgoals):
 1. c_guard p \<Longrightarrow> take (5 * size_of TYPE(cte_C)) (replicate (2 ^ tcbBlockSizeBits) 0) = replicate (5 * size_of TYPE(cte_C)) 0
 2. c_guard p \<Longrightarrow> 5 * size_of TYPE(cte_C) \<le> 2 ^ tcbBlockSizeBits
 3. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (2 subgoals):
 1. c_guard p \<Longrightarrow> 5 * size_of TYPE(cte_C) \<le> 2 ^ tcbBlockSizeBits
 2. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (1 subgoal):
 1. c_guard p \<Longrightarrow> (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) y) = (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) proof (prove)
goal (1 subgoal):
 1. c_guard p \<Longrightarrow> \<forall>xa. xa \<notin> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} \<longrightarrow> clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) xa = cslift x xa proof (prove)
goal (1 subgoal):
 1. c_guard p \<Longrightarrow> \<forall>xa. xa \<notin> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} \<longrightarrow> clift (hrs_mem_update (heap_update p (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (hrs_mem (hrs_mem_update (heap_update p (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p))) (t_hrs_' (globals x)))) p))) (hrs_mem_update (heap_update p (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p))) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) xa = cslift x xa proof (prove)
goal (1 subgoal):
 1. c_guard p \<Longrightarrow> \<forall>xa. xa \<notin> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} \<longrightarrow> clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))) xa = cslift x xa proof (prove)
goal (1 subgoal):
 1. c_guard p \<Longrightarrow> size_of TYPE(tcb_C) < 2 ^ word_bits proof (prove)
goal:
No subgoals! proof (state)
this:
cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = (\<lambda>y. if y \<in> ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0 proof (state)
goal (1 subgoal):
 1. heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0 proof (prove)
goal (1 subgoal):
 1. heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = take (size_of TYPE(tcb_C)) (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p)) (heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p))) proof (state)
this:
heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = take (size_of TYPE(tcb_C)) (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p)) (heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p)))

goal (1 subgoal):
 1. heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0 proof (state)
this:
heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = take (size_of TYPE(tcb_C)) (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p)) (heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p)))

goal (1 subgoal):
 1. heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0 proof (prove)
goal (1 subgoal):
 1. take (size_of TYPE(tcb_C)) (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p)) (heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p))) = replicate (size_of TYPE(tcb_C)) 0 proof (prove)
goal (1 subgoal):
 1. take (size_of TYPE(tcb_C)) (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p)) (replicate (2 ^ tcbBlockSizeBits) 0)) = replicate (size_of TYPE(tcb_C)) 0 proof (prove)
goal (1 subgoal):
 1. replicate (min (size_of TYPE(tcb_C)) (2 ^ tcbBlockSizeBits - unat (ptr_val p - ctcb_ptr_to_tcb_ptr p))) 0 = replicate (size_of TYPE(tcb_C)) 0 proof (prove)
goal (1 subgoal):
 1. min (size_of TYPE(tcb_C)) (2 ^ tcbBlockSizeBits - unat (ptr_val p - ctcb_ptr_to_tcb_ptr p)) = size_of TYPE(tcb_C) proof (prove)
goal:
No subgoals! proof (state)
this:
take (size_of TYPE(tcb_C)) (drop (unat (ptr_val p - ctcb_ptr_to_tcb_ptr p)) (heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr p))) = replicate (size_of TYPE(tcb_C)) 0

goal (1 subgoal):
 1. heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0 proof (chain)
picking this:
heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0 proof (prove)
using this:
heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0

goal (1 subgoal):
 1. heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0 proof (state)
this:
heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0

goal:
No subgoals! proof (state)
this:
heap_list (fst (t_hrs_' (globals x))) (size_of TYPE(tcb_C)) (ptr_val p) = replicate (size_of TYPE(tcb_C)) 0

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. ptr_retyp p (snd (t_hrs_' (globals x))) \<Turnstile>\<^sub>t p proof (prove)
using this:
c_guard p

goal (1 subgoal):
 1. ptr_retyp p (snd (t_hrs_' (globals x))) \<Turnstile>\<^sub>t p proof (state)
this:
ptr_retyp p (snd (t_hrs_' (globals x))) \<Turnstile>\<^sub>t p

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
using this:
ptr_retyp p (snd (t_hrs_' (globals x))) \<Turnstile>\<^sub>t p

goal (1 subgoal):
 1. clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)) proof (state)
this:
clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
using this:
clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0))

goal (1 subgoal):
 1. cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
using this:
clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0))
c_guard p

goal (1 subgoal):
 1. cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update p (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (heap_update p (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p)) (hrs_mem (t_hrs_' (globals x)))) p))) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update p (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (heap_update p (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p)) (hrs_mem (t_hrs_' (globals x)))) p))) (t_hrs_' (globals x))))) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> 5 * size_of TYPE(cte_C) < 2 ^ word_bits
 2. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update p (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (heap_update p (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p)) (hrs_mem (t_hrs_' (globals x)))) p))) (t_hrs_' (globals x)))) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update p (tcbTimeSlice_C_update (\<lambda>_. 5) (h_val (heap_update p (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p)) (hrs_mem (t_hrs_' (globals x)))) p))) (t_hrs_' (globals x)))) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> (clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))))(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])))) (h_val (hrs_mem (t_hrs_' (globals x))) p))) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> (clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))))(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (h_val (hrs_mem (t_hrs_' (globals x))) p)))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (h_val (hrs_mem (t_hrs_' (globals x))) p)))) (tcbArch_C (h_val (hrs_mem (t_hrs_' (globals x))) p))) (h_val (hrs_mem (t_hrs_' (globals x))) p))) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> (clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))))(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. \<And>p'. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p\<rbrakk> \<Longrightarrow> ((clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))))(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) p' = ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) p' proof (prove)
goal (1 subgoal):
 1. \<And>p'. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p; p' \<noteq> p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))) p' = cslift x p' proof (prove)
goal (2 subgoals):
 1. \<And>p'. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p; p' \<noteq> p; clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))) = (\<lambda>y. if y = p then Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)) else cslift x y)\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))) p' = cslift x p'
 2. \<And>p'. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p; p' \<noteq> p\<rbrakk> \<Longrightarrow> size_of TYPE(tcb_C) < 2 ^ word_bits proof (prove)
goal (1 subgoal):
 1. \<And>p'. \<lbrakk>clift (hrs_mem (t_hrs_' (globals x)), ptr_retyp p (snd (t_hrs_' (globals x)))) p = Some (from_bytes (replicate (size_of TYPE(tcb_C)) 0)); c_guard p; p' \<noteq> p\<rbrakk> \<Longrightarrow> size_of TYPE(tcb_C) < 2 ^ word_bits proof (prove)
goal:
No subgoals! proof (state)
this:
cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = (cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>typ_uinfo_t TYPE(tcb_C) \<bottom>\<^sub>t typ_uinfo_t TYPE('a); typ_uinfo_t TYPE(cte_C[5]) \<bottom>\<^sub>t typ_uinfo_t TYPE('a); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word)\<rbrakk> \<Longrightarrow> cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = cslift x proof (prove)
using this:
c_guard p

goal (1 subgoal):
 1. \<lbrakk>typ_uinfo_t TYPE(tcb_C) \<bottom>\<^sub>t typ_uinfo_t TYPE('a); typ_uinfo_t TYPE(cte_C[5]) \<bottom>\<^sub>t typ_uinfo_t TYPE('a); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word)\<rbrakk> \<Longrightarrow> cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = cslift x proof (prove)
goal (1 subgoal):
 1. \<lbrakk>typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x)))))) = cslift x proof (prove)
goal (1 subgoal):
 1. \<lbrakk>typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (t_hrs_' (globals x))))) = cslift x proof (prove)
goal (1 subgoal):
 1. \<lbrakk>typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))))) = cslift x proof (prove)
goal (1 subgoal):
 1. \<lbrakk>typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))) = cslift x proof (prove)
goal (2 subgoals):
 1. \<lbrakk>typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word); c_guard p\<rbrakk> \<Longrightarrow> clift (hrs_htd_update (ptr_retyp p) (t_hrs_' (globals x))) = clift (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))
 2. \<lbrakk>typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word); c_guard p\<rbrakk> \<Longrightarrow> size_of TYPE(tcb_C) < 2 ^ word_bits proof (prove)
goal (1 subgoal):
 1. \<lbrakk>typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE('a) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE('a) \<noteq> typ_uinfo_t TYPE(8 word); c_guard p\<rbrakk> \<Longrightarrow> size_of TYPE(tcb_C) < 2 ^ word_bits proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>typ_uinfo_t TYPE(tcb_C) \<bottom>\<^sub>t typ_uinfo_t TYPE(?'a4); typ_uinfo_t TYPE(cte_C[5]) \<bottom>\<^sub>t typ_uinfo_t TYPE(?'a4); typ_uinfo_t TYPE(?'a4) \<noteq> typ_uinfo_t TYPE(8 word)\<rbrakk> \<Longrightarrow> cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) = cslift x

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<forall>v. projectKO_opt kotcb \<noteq> Some v \<Longrightarrow> projectKO_opt \<circ>\<^sub>m ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject) = projectKO_opt \<circ>\<^sub>m ks proof (prove)
using this:
pspace_no_overlap' (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)

goal (1 subgoal):
 1. \<forall>v. projectKO_opt kotcb \<noteq> Some v \<Longrightarrow> projectKO_opt \<circ>\<^sub>m ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject) = projectKO_opt \<circ>\<^sub>m ks proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>v. projectKO_opt kotcb \<noteq> Some v; pspace_no_overlap' (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (\<sigma>\<lparr>ksPSpace := ks\<rparr>); is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> projectKO_opt \<circ>\<^sub>m ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject) = projectKO_opt \<circ>\<^sub>m ks proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_no_overlap' (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (\<sigma>\<lparr>ksPSpace := ks\<rparr>); is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); projectKO_opt \<circ>\<^sub>m (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>))(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb) = projectKO_opt \<circ>\<^sub>m ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> projectKO_opt \<circ>\<^sub>m ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject) = projectKO_opt \<circ>\<^sub>m ks proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>v. projectKO_opt kotcb \<noteq> Some v \<Longrightarrow> projectKO_opt \<circ>\<^sub>m ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject) = projectKO_opt \<circ>\<^sub>m ks

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. map_to_tcbs (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject) proof (prove)
goal (1 subgoal):
 1. \<And>x. map_to_tcbs (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) x = ((map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)) x proof (prove)
goal:
No subgoals! proof (state)
this:
map_to_tcbs (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>dev. makeObjectKO dev (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Some kotcb proof (state)
this:
makeObjectKO ?dev5 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Some kotcb

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) ?n \<Longrightarrow> map_to_ctes (\<lambda>xa. if xa \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) ?n \<Longrightarrow> map_to_ctes (\<lambda>xa. if xa \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>y. (y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (state)
goal (1 subgoal):
 1. \<And>y. (y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (state)
goal (1 subgoal):
 1. \<And>y. (y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (prove)
goal (1 subgoal):
 1. \<And>k. k < 5 \<Longrightarrow> ctcb_ptr_to_tcb_ptr p + word_of_nat k * word_of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits = word_of_nat k * word_of_nat (size_of TYPE(cte_C)) \<and> ctcb_ptr_to_tcb_ptr p + word_of_nat k * word_of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p proof (prove)
using this:
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)

goal (1 subgoal):
 1. \<And>k. k < 5 \<Longrightarrow> ctcb_ptr_to_tcb_ptr p + word_of_nat k * word_of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits = word_of_nat k * word_of_nat (size_of TYPE(cte_C)) \<and> ctcb_ptr_to_tcb_ptr p + word_of_nat k * word_of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p proof (prove)
goal (1 subgoal):
 1. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p + word_of_nat k * word_of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits = word_of_nat k * word_of_nat (size_of TYPE(cte_C)) \<and> ctcb_ptr_to_tcb_ptr p + word_of_nat k * word_of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p proof (prove)
goal (2 subgoals):
 1. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits
 2. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> word_of_nat k * word_of_nat (size_of TYPE(cte_C)) < 2 ^ tcbBlockSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> word_of_nat k * word_of_nat (size_of TYPE(cte_C)) < 2 ^ tcbBlockSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> word_of_nat (k * size_of TYPE(cte_C)) < 2 ^ tcbBlockSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> unat (word_of_nat (k * size_of TYPE(cte_C))) < unat (2 ^ tcbBlockSizeBits) proof (prove)
goal (2 subgoals):
 1. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> k * size_of TYPE(cte_C) < 2 ^ word_bits
 2. \<And>k. \<lbrakk>k < 5; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)\<rbrakk> \<Longrightarrow> k * size_of TYPE(cte_C) < unat (2 ^ tcbBlockSizeBits) proof (prove)
goal:
No subgoals! proof (state)
this:
?k5 < 5 \<Longrightarrow> ctcb_ptr_to_tcb_ptr p + word_of_nat ?k5 * word_of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits = word_of_nat ?k5 * word_of_nat (size_of TYPE(cte_C)) \<and> ctcb_ptr_to_tcb_ptr p + word_of_nat ?k5 * word_of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p

goal (1 subgoal):
 1. \<And>y. (y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (prove)
goal (1 subgoal):
 1. \<And>k. k < 5 \<Longrightarrow> unat (word_of_nat k * word_of_nat (size_of TYPE(cte_C))) = k * 2 ^ cteSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>k. k < 5 \<Longrightarrow> unat (word_of_nat (k * size_of TYPE(cte_C))) = k * 2 ^ cteSizeBits proof (prove)
goal (2 subgoals):
 1. \<And>k. k < 5 \<Longrightarrow> k * size_of TYPE(cte_C) < 2 ^ word_bits
 2. \<And>k. k < 5 \<Longrightarrow> k * size_of TYPE(cte_C) = k * 2 ^ cteSizeBits proof (prove)
goal:
No subgoals! proof (state)
this:
?k5 < 5 \<Longrightarrow> unat (word_of_nat ?k5 * word_of_nat (size_of TYPE(cte_C))) = ?k5 * 2 ^ cteSizeBits

goal (1 subgoal):
 1. \<And>y. (y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (prove)
goal (1 subgoal):
 1. (y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (prove)
using this:
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)

goal (1 subgoal):
 1. (y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (prove)
goal (1 subgoal):
 1. is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits \<Longrightarrow> (y \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C))) ` {k. k < 5}\<rbrakk> \<Longrightarrow> y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases
 2. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases\<rbrakk> \<Longrightarrow> y \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C))) ` {k. k < 5} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y = ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)); x < 5\<rbrakk> \<Longrightarrow> \<exists>y<5. x * 2 ^ cteSizeBits = y * 16
 2. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases\<rbrakk> \<Longrightarrow> y \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C))) ` {k. k < 5} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases\<rbrakk> \<Longrightarrow> y \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C))) ` {k. k < 5} proof (prove)
goal (1 subgoal):
 1. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> y \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C))) ` {k. k < 5} proof (prove)
goal (2 subgoals):
 1. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> y = ctcb_ptr_to_tcb_ptr p + word_of_nat ya * word_of_nat (size_of TYPE(cte_C))
 2. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> ya \<in> {k. k < 5} proof (prove)
goal (3 subgoals):
 1. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> y && mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p + word_of_nat ya * word_of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits
 2. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p + word_of_nat ya * word_of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits
 3. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> ya \<in> {k. k < 5} proof (prove)
goal (3 subgoals):
 1. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> unat (y && mask tcbBlockSizeBits) = unat (ctcb_ptr_to_tcb_ptr p + word_of_nat ya * word_of_nat (size_of TYPE(cte_C)) && mask tcbBlockSizeBits)
 2. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p + word_of_nat ya * word_of_nat (size_of TYPE(cte_C)) && ~~ mask tcbBlockSizeBits
 3. \<And>ya. \<lbrakk>is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits; y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p; ya < 5; unat (y && mask tcbBlockSizeBits) = ya * 16\<rbrakk> \<Longrightarrow> ya \<in> {k. k < 5} proof (prove)
goal:
No subgoals! proof (state)
this:
(y \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases)

goal:
No subgoals! proof (state)
this:
(?y5 \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (?y5 && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> ?y5 && mask tcbBlockSizeBits \<in> dom tcb_cte_cases)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (chain)
picking this:
range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) ?n \<Longrightarrow> map_to_ctes (\<lambda>xa. if xa \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)
(?y5 \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (?y5 && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> ?y5 && mask tcbBlockSizeBits \<in> dom tcb_cte_cases) proof (prove)
using this:
range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) ?n \<Longrightarrow> map_to_ctes (\<lambda>xa. if xa \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<?n} \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)
(?y5 \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5}) = (?y5 && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> ?y5 && mask tcbBlockSizeBits \<in> dom tcb_cte_cases)

goal (1 subgoal):
 1. map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5} then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>n. range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) n \<Longrightarrow> map_to_ctes (\<lambda>xa. if xa \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<n} then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<n} \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x); \<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases)\<rbrakk> \<Longrightarrow> map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases); range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) (Suc 0) \<Longrightarrow> map_to_ctes (\<lambda>xa. if xa \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<Suc 0} then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits \<in> (\<lambda>x. ctcb_ptr_to_tcb_ptr p + (word_of_nat x << objBitsKO kotcb)) ` {0..<Suc 0} \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)\<rbrakk> \<Longrightarrow> map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases); range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) (Suc 0) \<Longrightarrow> map_to_ctes (\<lambda>xa. if xa = ctcb_ptr_to_tcb_ptr p then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)\<rbrakk> \<Longrightarrow> map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) proof (prove)
goal (2 subgoals):
 1. (\<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases)) \<Longrightarrow> range_cover (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb) (objBitsKO kotcb) (Suc 0)
 2. \<lbrakk>\<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases); map_to_ctes (\<lambda>xa. if xa = ctcb_ptr_to_tcb_ptr p then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)\<rbrakk> \<Longrightarrow> map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) proof (prove)
goal (2 subgoals):
 1. (\<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases)) \<Longrightarrow> objBitsKO kotcb < word_bits
 2. \<lbrakk>\<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases); map_to_ctes (\<lambda>xa. if xa = ctcb_ptr_to_tcb_ptr p then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)\<rbrakk> \<Longrightarrow> map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>y. (y \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5}) = (y && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> y && mask tcbBlockSizeBits \<in> dom tcb_cte_cases); map_to_ctes (\<lambda>xa. if xa = ctcb_ptr_to_tcb_ptr p then Some kotcb else ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>) xa) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else ctes_of (\<sigma>\<lparr>ksPSpace := ks\<rparr>) x)\<rbrakk> \<Longrightarrow> map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x && ~~ mask tcbBlockSizeBits = ctcb_ptr_to_tcb_ptr p \<and> x && mask tcbBlockSizeBits \<in> dom tcb_cte_cases then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) proof (prove)
goal:
No subgoals! proof (state)
this:
map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> KOTCB makeObject)) = (\<lambda>x. if x \<in> ptr_val ` ((+\<^sub>p) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) \<circ> int) ` {k. k < 5} then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x)

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. from_bytes (replicate (size_of TYPE(tcb_C)) 0) = tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined)))))))))))))) proof (prove)
goal (1 subgoal):
 1. update_ti_t (typ_info_t TYPE(tcb_C)) (replicate (size_of TYPE(tcb_C)) 0) undefined = tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined)))))))))))))) proof (prove)
goal (1 subgoal):
 1. update_ti_t (final_pad (ti_typ_pad_combine TYPE(tcb_C ptr) tcbEPPrev_C (tcbEPPrev_C_update \<circ> (\<lambda>x _. x)) ''tcbEPPrev_C'' (ti_typ_pad_combine TYPE(tcb_C ptr) tcbEPNext_C (tcbEPNext_C_update \<circ> (\<lambda>x _. x)) ''tcbEPNext_C'' (ti_typ_pad_combine TYPE(tcb_C ptr) tcbSchedPrev_C (tcbSchedPrev_C_update \<circ> (\<lambda>x _. x)) ''tcbSchedPrev_C'' (ti_typ_pad_combine TYPE(tcb_C ptr) tcbSchedNext_C (tcbSchedNext_C_update \<circ> (\<lambda>x _. x)) ''tcbSchedNext_C'' (ti_typ_pad_combine TYPE(32 word) tcbIPCBuffer_C (tcbIPCBuffer_C_update \<circ> (\<lambda>x _. x)) ''tcbIPCBuffer_C'' (ti_typ_pad_combine TYPE(32 word) tcbFaultHandler_C (tcbFaultHandler_C_update \<circ> (\<lambda>x _. x)) ''tcbFaultHandler_C'' (ti_typ_pad_combine TYPE(32 word) tcbTimeSlice_C (tcbTimeSlice_C_update \<circ> (\<lambda>x _. x)) ''tcbTimeSlice_C'' (ti_typ_pad_combine TYPE(32 word) tcbPriority_C (tcbPriority_C_update \<circ> (\<lambda>x _. x)) ''tcbPriority_C'' (ti_typ_pad_combine TYPE(32 word) tcbMCP_C (tcbMCP_C_update \<circ> (\<lambda>x _. x)) ''tcbMCP_C'' (ti_typ_pad_combine TYPE(32 word) tcbDomain_C (tcbDomain_C_update \<circ> (\<lambda>x _. x)) ''tcbDomain_C'' (ti_typ_pad_combine TYPE(lookup_fault_C) tcbLookupFailure_C (tcbLookupFailure_C_update \<circ> (\<lambda>x _. x)) ''tcbLookupFailure_C'' (ti_typ_pad_combine TYPE(seL4_Fault_C) tcbFault_C (tcbFault_C_update \<circ> (\<lambda>x _. x)) ''tcbFault_C'' (ti_typ_pad_combine TYPE(notification_C ptr) tcbBoundNotification_C (tcbBoundNotification_C_update \<circ> (\<lambda>x _. x)) ''tcbBoundNotification_C'' (ti_typ_pad_combine TYPE(thread_state_C) tcbState_C (tcbState_C_update \<circ> (\<lambda>x _. x)) ''tcbState_C'' (ti_typ_pad_combine TYPE(arch_tcb_C) tcbArch_C (tcbArch_C_update \<circ> (\<lambda>x _. x)) ''tcbArch_C'' (empty_typ_info ''tcb_C''))))))))))))))))) (replicate (size_of TYPE(tcb_C)) 0) undefined = tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined)))))))))))))) proof (prove)
goal (1 subgoal):
 1. update_ti_t (adjust_ti (typ_info_t TYPE(arch_tcb_C)) tcbArch_C (tcbArch_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(thread_state_C)) tcbState_C (tcbState_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(notification_C ptr)) tcbBoundNotification_C (tcbBoundNotification_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(seL4_Fault_C)) tcbFault_C (tcbFault_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(lookup_fault_C)) tcbLookupFailure_C (tcbLookupFailure_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbDomain_C (tcbDomain_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbMCP_C (tcbMCP_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbPriority_C (tcbPriority_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbTimeSlice_C (tcbTimeSlice_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbFaultHandler_C (tcbFaultHandler_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbIPCBuffer_C (tcbIPCBuffer_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbSchedNext_C (tcbSchedNext_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbSchedPrev_C (tcbSchedPrev_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbEPNext_C (tcbEPNext_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbEPPrev_C (tcbEPPrev_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] undefined)))))))))))))) = tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined)))))))))))))) proof (prove)
goal (1 subgoal):
 1. update_ti_t (adjust_ti (typ_info_t TYPE(arch_tcb_C)) tcbArch_C (tcbArch_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(thread_state_C)) tcbState_C (tcbState_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(notification_C ptr)) tcbBoundNotification_C (tcbBoundNotification_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(seL4_Fault_C)) tcbFault_C (tcbFault_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(lookup_fault_C)) tcbLookupFailure_C (tcbLookupFailure_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0, 0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbDomain_C (tcbDomain_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbMCP_C (tcbMCP_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbPriority_C (tcbPriority_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbTimeSlice_C (tcbTimeSlice_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbFaultHandler_C (tcbFaultHandler_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(32 word)) tcbIPCBuffer_C (tcbIPCBuffer_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbSchedNext_C (tcbSchedNext_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbSchedPrev_C (tcbSchedPrev_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbEPNext_C (tcbEPNext_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] (update_ti_t (adjust_ti (typ_info_t TYPE(tcb_C ptr)) tcbEPPrev_C (tcbEPPrev_C_update \<circ> (\<lambda>x _. x))) [0, 0, 0, 0] undefined)))))))))))))) = tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined)))))))))))))) proof (prove)
goal (1 subgoal):
 1. tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. update_ti_t (typ_info_t TYPE(32 word[2])) [0, 0, 0, 0, 0, 0, 0, 0] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. update_ti_t (typ_info_t TYPE(32 word[2])) [0, 0, 0, 0, 0, 0, 0, 0] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. update_ti_t (typ_info_t TYPE(32 word[3])) [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. update_ti_t (typ_info_t TYPE(32 word[20])) [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined)))))))))))))) = tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined)))))))))))))) proof (prove)
goal:
No subgoals! proof (state)
this:
from_bytes (replicate (size_of TYPE(tcb_C)) 0) = tcbBoundNotification_C_update (\<lambda>_. NULL) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) (tcbIPCBuffer_C_update (\<lambda>_. 0) (tcbFaultHandler_C_update (\<lambda>_. 0) (tcbTimeSlice_C_update (\<lambda>_. 0) (tcbDomain_C_update (\<lambda>_. 0) (tcbMCP_C_update (\<lambda>_. 0) (tcbPriority_C_update (\<lambda>_. 0) (tcbLookupFailure_C_update (\<lambda>_. lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)) (tcbFault_C_update (\<lambda>_. seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) (tcbState_C_update (\<lambda>_. thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) undefined))))))))))))))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. ctcb_relation makeObject (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. tcbFaultHandler (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB) = tcbFaultHandler_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) \<and> cthread_state_relation (tcbState (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB)) (tcbState_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))), tcbFault_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) \<and> tcbIPCBuffer (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB) = tcbIPCBuffer_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) \<and> carch_tcb_relation (tcbArch (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB)) (tcbArch_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) \<and> tcbQueued (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB) = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB)) = tcbDomain_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) \<and> UCAST(8 \<rightarrow> 32) (tcbPriority (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB)) = tcbPriority_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) \<and> UCAST(8 \<rightarrow> 32) (tcbMCP (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB)) = tcbMCP_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) \<and> tcbTimeSlice (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB) = unat (tcbTimeSlice_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) \<and> cfault_rel (tcbFault (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB)) (seL4_Fault_lift (tcbFault_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) (lookup_fault_lift (tcbLookupFailure_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) \<and> option_to_ptr (tcbBoundNotification (Thread makeObject makeObject makeObject makeObject makeObject minBound Structures_H.thread_state.Inactive minBound minBound False Nothing timeSlice (CPtr 0) (VPtr 0) Nothing newArchTCB)) = tcbBoundNotification_C (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) proof (prove)
goal (1 subgoal):
 1. cthread_state_relation Structures_H.thread_state.Inactive (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined), seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined)) \<and> carch_tcb_relation newArchTCB (tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined)) \<and> \<not> to_bool (tcbQueued_CL (thread_state_lift (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined)))) \<and> timeSlice = 5 \<and> cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined))) \<and> option_to_ptr None = NULL proof (prove)
goal (6 subgoals):
 1. cthread_state_relation Structures_H.thread_state.Inactive (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined), seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))
 2. carch_tcb_relation newArchTCB (tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined))
 3. \<not> to_bool (tcbQueued_CL (thread_state_lift (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined))))
 4. timeSlice = 5
 5. cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)))
 6. option_to_ptr None = NULL proof (prove)
goal (5 subgoals):
 1. carch_tcb_relation newArchTCB (tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C undefined))) (tcbArch_C undefined))
 2. \<not> to_bool (tcbQueued_CL (thread_state_lift (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined))))
 3. timeSlice = 5
 4. cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)))
 5. option_to_ptr None = NULL proof (prove)
goal (5 subgoals):
 1. \<forall>r. atcbContextGet newArchTCB r = Arrays.update (foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (unat Kernel_C.CPSR) 0x150.[unat (register_from_H r)]
 2. \<not> to_bool (tcbQueued_CL (thread_state_lift (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined))))
 3. timeSlice = 5
 4. cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)))
 5. option_to_ptr None = NULL proof (prove)
goal (5 subgoals):
 1. \<And>r. atcbContextGet newArchTCB r = Arrays.update (foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (unat Kernel_C.CPSR) 0x150.[unat (register_from_H r)]
 2. \<not> to_bool (tcbQueued_CL (thread_state_lift (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined))))
 3. timeSlice = 5
 4. cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)))
 5. option_to_ptr None = NULL proof (prove)
goal (1 subgoal):
 1. atcbContextGet newArchTCB r = Arrays.update (foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<20] (registers_C (tcbContext_C (tcbArch_C undefined)))) (unat Kernel_C.CPSR) 0x150.[unat (register_from_H r)] proof (prove)
goal (4 subgoals):
 1. \<not> to_bool (tcbQueued_CL (thread_state_lift (thread_state_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<3] (thread_state_C.words_C (tcbState_C undefined))) (tcbState_C undefined))))
 2. timeSlice = 5
 3. cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)))
 4. option_to_ptr None = NULL proof (prove)
goal (3 subgoals):
 1. timeSlice = Suc (Suc (Suc (Suc (Suc 0))))
 2. cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)))
 3. option_to_ptr None = NULL proof (prove)
goal (2 subgoals):
 1. cfault_rel None (seL4_Fault_lift (seL4_Fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (seL4_Fault_C.words_C (tcbFault_C undefined))) (tcbFault_C undefined))) (lookup_fault_lift (lookup_fault_C.words_C_update (\<lambda>_. foldr (\<lambda>n arr. Arrays.update arr n 0) [0..<2] (lookup_fault_C.words_C (tcbLookupFailure_C undefined))) (tcbLookupFailure_C undefined)))
 2. option_to_ptr None = NULL proof (prove)
goal:
No subgoals! proof (state)
this:
ctcb_relation makeObject (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. ks (ctcb_ptr_to_tcb_ptr p) = None proof (state)
this:
ks (ctcb_ptr_to_tcb_ptr p) = None

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>p' list. map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
using this:
sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>))
ks (ctcb_ptr_to_tcb_ptr p) = None
pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)

goal (1 subgoal):
 1. \<And>p' list. map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (3 subgoals):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 2. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 3. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (Structures_H.endpoint.RecvEP list) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (2 subgoals):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 2. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (Structures_H.endpoint.RecvEP list) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (Structures_H.endpoint.RecvEP list) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = refs_of' (injectKOS (Structures_H.endpoint.RecvEP list)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.RecvEP list)). ko_wp_at' (\<lambda>ko. (p', symreftype tp) \<in> refs_of' ko) x (\<sigma>\<lparr>ksPSpace := ks\<rparr>))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps ks p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = set list \<times> {EPRecv}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (p', TCBBlockedRecv) \<in> refs_of' ko) x (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ctcb_ptr_to_tcb_ptr p \<in> set list\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps ks p' = Some (Structures_H.endpoint.RecvEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = set list \<times> {EPRecv}; ctcb_ptr_to_tcb_ptr p \<in> set list; ko_wp_at' (\<lambda>ko. (p', TCBBlockedRecv) \<in> refs_of' ko) (ctcb_ptr_to_tcb_ptr p) (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
map_to_eps ks ?p'5 = Some (Structures_H.endpoint.RecvEP ?list5) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set ?list5

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>p' list. map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
using this:
sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>))
ks (ctcb_ptr_to_tcb_ptr p) = None
pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)

goal (1 subgoal):
 1. \<And>p' list. map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (3 subgoals):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 2. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 3. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (Structures_H.endpoint.SendEP list) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (2 subgoals):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 2. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (Structures_H.endpoint.SendEP list) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (Structures_H.endpoint.SendEP list) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = refs_of' (injectKOS (Structures_H.endpoint.SendEP list)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP list)). ko_wp_at' (\<lambda>ko. (p', symreftype tp) \<in> refs_of' ko) x (\<sigma>\<lparr>ksPSpace := ks\<rparr>))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps ks p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = set list \<times> {EPSend}; \<forall>x\<in>set list. ko_wp_at' (\<lambda>ko. (p', TCBBlockedSend) \<in> refs_of' ko) x (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ctcb_ptr_to_tcb_ptr p \<in> set list\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p' list. \<lbrakk>map_to_eps ks p' = Some (Structures_H.endpoint.SendEP list); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = set list \<times> {EPSend}; ctcb_ptr_to_tcb_ptr p \<in> set list; ko_wp_at' (\<lambda>ko. (p', TCBBlockedSend) \<in> refs_of' ko) (ctcb_ptr_to_tcb_ptr p) (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
map_to_eps ks ?p'5 = Some (Structures_H.endpoint.SendEP ?list5) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set ?list5

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>p' list boundTCB. map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
using this:
sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>))
ks (ctcb_ptr_to_tcb_ptr p) = None
pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)

goal (1 subgoal):
 1. \<And>p' list boundTCB. map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (3 subgoals):
 1. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 2. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 3. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (2 subgoals):
 1. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)
 2. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB) p' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns (ksPSpace (\<sigma>\<lparr>ksPSpace := ks\<rparr>)) p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = refs_of' (injectKOS (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB)). ko_wp_at' (\<lambda>ko. (p', symreftype tp) \<in> refs_of' ko) x (\<sigma>\<lparr>ksPSpace := ks\<rparr>))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set list proof (prove)
goal (1 subgoal):
 1. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns ks p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' boundTCB; \<forall>x\<in>set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' boundTCB. case x of (x, tp) \<Rightarrow> ko_wp_at' (\<lambda>ko. (p', symreftype tp) \<in> refs_of' ko) x (\<sigma>\<lparr>ksPSpace := ks\<rparr>); ctcb_ptr_to_tcb_ptr p \<in> set list\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p' list boundTCB. \<lbrakk>map_to_ntfns ks p' = Some (NTFN (Structures_H.ntfn.WaitingNtfn list) boundTCB); sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>)); ks (ctcb_ptr_to_tcb_ptr p) = None; pspace_aligned' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); pspace_distinct' (\<sigma>\<lparr>ksPSpace := ks\<rparr>); state_refs_of' (\<sigma>\<lparr>ksPSpace := ks\<rparr>) p' = set list \<times> {NTFNSignal} \<union> ntfn_bound_refs' boundTCB; ctcb_ptr_to_tcb_ptr p \<in> set list; case (ctcb_ptr_to_tcb_ptr p, NTFNSignal) of (x, tp) \<Rightarrow> ko_wp_at' (\<lambda>ko. (p', symreftype tp) \<in> refs_of' ko) x (\<sigma>\<lparr>ksPSpace := ks\<rparr>)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
map_to_ntfns ks ?p'5 = Some (NTFN (Structures_H.ntfn.WaitingNtfn ?list5) ?boundTCB5) \<Longrightarrow> ctcb_ptr_to_tcb_ptr p \<notin> set ?list5

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None proof (prove)
using this:
ks (ctcb_ptr_to_tcb_ptr p) = None
dom (ksPSpace \<sigma>) \<subseteq> dom ks

goal (1 subgoal):
 1. ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ks (ctcb_ptr_to_tcb_ptr p) = None; dom (ksPSpace \<sigma>) \<subseteq> dom ks\<rbrakk> \<Longrightarrow> ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dom (ksPSpace \<sigma>) \<subseteq> dom ks; ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) \<noteq> None\<rbrakk> \<Longrightarrow> ks (ctcb_ptr_to_tcb_ptr p) \<noteq> None proof (prove)
goal:
No subgoals! proof (state)
this:
ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
using this:
ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None

goal (1 subgoal):
 1. \<And>qdom prio. ctcb_ptr_to_tcb_ptr p \<notin> set (ksReadyQueues \<sigma> (qdom, prio)) proof (prove)
using this:
ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None
Invariants_H.valid_queues \<sigma>

goal (1 subgoal):
 1. \<And>qdom prio. ctcb_ptr_to_tcb_ptr p \<notin> set (ksReadyQueues \<sigma> (qdom, prio)) proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues \<sigma> (d, p)). obj_at' (inQ d p and runnable' \<circ> tcbState) t \<sigma>) \<and> distinct (ksReadyQueues \<sigma> (d, p)) \<and> (maxDomain < d \<longrightarrow> ksReadyQueues \<sigma> (d, p) = []) \<and> (maxPriority < p \<longrightarrow> ksReadyQueues \<sigma> (d, p) = []); valid_bitmapQ \<sigma>; bitmapQ_no_L2_orphans \<sigma>; bitmapQ_no_L1_orphans \<sigma>; ctcb_ptr_to_tcb_ptr p \<in> set (ksReadyQueues \<sigma> (qdom, prio))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None; valid_bitmapQ \<sigma>; bitmapQ_no_L2_orphans \<sigma>; bitmapQ_no_L1_orphans \<sigma>; ctcb_ptr_to_tcb_ptr p \<in> set (ksReadyQueues \<sigma> (qdom, prio)); \<forall>p. (\<forall>t\<in>set (ksReadyQueues \<sigma> (qdom, p)). obj_at' (inQ qdom p and runnable' \<circ> tcbState) t \<sigma>) \<and> distinct (ksReadyQueues \<sigma> (qdom, p)) \<and> (maxDomain < qdom \<longrightarrow> ksReadyQueues \<sigma> (qdom, p) = []) \<and> (maxPriority < p \<longrightarrow> ksReadyQueues \<sigma> (qdom, p) = [])\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None; valid_bitmapQ \<sigma>; bitmapQ_no_L2_orphans \<sigma>; bitmapQ_no_L1_orphans \<sigma>; ctcb_ptr_to_tcb_ptr p \<in> set (ksReadyQueues \<sigma> (qdom, prio)); (\<forall>t\<in>set (ksReadyQueues \<sigma> (qdom, prio)). obj_at' (inQ qdom prio and runnable' \<circ> tcbState) t \<sigma>) \<and> distinct (ksReadyQueues \<sigma> (qdom, prio)) \<and> (maxDomain < qdom \<longrightarrow> ksReadyQueues \<sigma> (qdom, prio) = []) \<and> (maxPriority < prio \<longrightarrow> ksReadyQueues \<sigma> (qdom, prio) = [])\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None; valid_bitmapQ \<sigma>; bitmapQ_no_L2_orphans \<sigma>; bitmapQ_no_L1_orphans \<sigma>; ctcb_ptr_to_tcb_ptr p \<in> set (ksReadyQueues \<sigma> (qdom, prio)); \<forall>t\<in>set (ksReadyQueues \<sigma> (qdom, prio)). obj_at' (inQ qdom prio and runnable' \<circ> tcbState) t \<sigma>; distinct (ksReadyQueues \<sigma> (qdom, prio)); maxDomain < qdom \<longrightarrow> ksReadyQueues \<sigma> (qdom, prio) = []; maxPriority < prio \<longrightarrow> ksReadyQueues \<sigma> (qdom, prio) = []\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>ksPSpace \<sigma> (ctcb_ptr_to_tcb_ptr p) = None; valid_bitmapQ \<sigma>; bitmapQ_no_L2_orphans \<sigma>; bitmapQ_no_L1_orphans \<sigma>; ctcb_ptr_to_tcb_ptr p \<in> set (ksReadyQueues \<sigma> (qdom, prio)); distinct (ksReadyQueues \<sigma> (qdom, prio)); maxDomain < qdom \<longrightarrow> ksReadyQueues \<sigma> (qdom, prio) = []; maxPriority < prio \<longrightarrow> ksReadyQueues \<sigma> (qdom, prio) = []; obj_at' (inQ qdom prio and runnable' \<circ> tcbState) (ctcb_ptr_to_tcb_ptr p) \<sigma>\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
ctcb_ptr_to_tcb_ptr p \<notin> set (ksReadyQueues \<sigma> (?qdom5, ?prio5))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>P S R. \<lbrakk>\<forall>x\<in>S. P x; R \<subseteq> S\<rbrakk> \<Longrightarrow> \<forall>x\<in>R. P x proof (state)
this:
\<lbrakk>\<forall>x\<in>?S5. ?P5 x; ?R5 \<subseteq> ?S5\<rbrakk> \<Longrightarrow> \<forall>x\<in>?R5. ?P5 x

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. - domain \<subseteq> kernel_data_refs proof (prove)
using this:
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> rf_sr

goal (1 subgoal):
 1. - domain \<subseteq> kernel_data_refs proof (prove)
using this:
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> {(s, s'). cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) \<and> cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> ptr_span intStateIRQNode_array_Ptr \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> ptr_span armKSGlobalPD_Ptr \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s}

goal (1 subgoal):
 1. - domain \<subseteq> kernel_data_refs proof (state)
this:
- domain \<subseteq> kernel_data_refs

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) proof (prove)
using this:
{ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}

goal (1 subgoal):
 1. htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>htd_safe domain (hrs_htd (t_hrs_' (globals x))); {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>htd_safe domain (hrs_htd (t_hrs_' (globals x))); {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}\<rbrakk> \<Longrightarrow> ptr_span p \<inter> kernel_data_refs = {}
 2. \<lbrakk>htd_safe domain (hrs_htd (t_hrs_' (globals x))); {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<inter> kernel_data_refs = {} proof (prove)
goal (2 subgoals):
 1. htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> ptr_span p \<subseteq> {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits}
 2. \<lbrakk>htd_safe domain (hrs_htd (t_hrs_' (globals x))); {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<inter> kernel_data_refs = {} proof (prove)
goal (2 subgoals):
 1. htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> {ptr_val p..+152} \<subseteq> {ptr_val p - ctcb_offset..+2 ^ tcbBlockSizeBits}
 2. \<lbrakk>htd_safe domain (hrs_htd (t_hrs_' (globals x))); {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<inter> kernel_data_refs = {} proof (prove)
goal (2 subgoals):
 1. htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> unat ctcb_offset + 152 \<le> 2 ^ tcbBlockSizeBits
 2. \<lbrakk>htd_safe domain (hrs_htd (t_hrs_' (globals x))); {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<inter> kernel_data_refs = {} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>htd_safe domain (hrs_htd (t_hrs_' (globals x))); {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<inter> kernel_data_refs = {} proof (prove)
goal (1 subgoal):
 1. htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<subseteq> {ctcb_ptr_to_tcb_ptr p..+2 ^ tcbBlockSizeBits} proof (prove)
goal (1 subgoal):
 1. htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> 5 * size_of TYPE(cte_C) \<le> 2 ^ tcbBlockSizeBits proof (prove)
goal:
No subgoals! proof (state)
this:
htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) proof (prove)
using this:
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> rf_sr

goal (1 subgoal):
 1. zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) proof (state)
this:
zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. hrs_htd (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<Turnstile>\<^sub>t p proof (prove)
using this:
cslift (x\<lparr>globals := t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)\<rparr>) p = ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) p

goal (1 subgoal):
 1. hrs_htd (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<Turnstile>\<^sub>t p proof (state)
this:
hrs_htd (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<Turnstile>\<^sub>t p

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) proof (prove)
using this:
zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x))
hrs_htd (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<Turnstile>\<^sub>t p
(valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb}) \<sigma>
is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb)

goal (1 subgoal):
 1. zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> caps_overlap_reserved' (ptr_span p) \<sigma>
 2. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<sigma> proof (prove)
goal (2 subgoals):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>\<rbrakk> \<Longrightarrow> ptr_span p \<subseteq> {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb}
 2. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<sigma> proof (prove)
goal (3 subgoals):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>\<rbrakk> \<Longrightarrow> is_aligned (ctcb_ptr_to_tcb_ptr p) tcbBlockSizeBits
 2. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+2 ^ objBits ?tcb13} \<subseteq> {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb}
 3. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<sigma> proof (prove)
goal (2 subgoals):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+2 ^ objBits ?tcb13} \<subseteq> {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb}
 2. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} \<sigma>\<rbrakk> \<Longrightarrow> caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr p..+5 * size_of TYPE(cte_C)} \<subseteq> {ctcb_ptr_to_tcb_ptr p..+2 ^ objBitsKO kotcb} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t p; is_aligned (ctcb_ptr_to_tcb_ptr p) (objBitsKO kotcb); valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>\<rbrakk> \<Longrightarrow> 5 * size_of TYPE(cte_C) \<le> 2 ^ objBitsKO kotcb proof (prove)
goal:
No subgoals! proof (state)
this:
zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
\<lbrakk>typ_uinfo_t TYPE(?'a5) \<bottom>\<^sub>t typ_uinfo_t TYPE(tcb_C); typ_uinfo_t TYPE(?'a5) \<bottom>\<^sub>t typ_uinfo_t TYPE(cte_C[5]); typ_uinfo_t TYPE(?'a5) \<noteq> typ_uinfo_t TYPE(8 word)\<rbrakk> \<Longrightarrow> h_t_valid (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) c_guard = c_h_t_valid x

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
?htd,?gd \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr = (?gd intStateIRQNode_array_Ptr \<and> h_t_array_valid ?htd (PTR_COERCE(cte_C[256] \<rightarrow> cte_C) intStateIRQNode_array_Ptr) CARD(256))
h_t_array_valid (hrs_htd (t_hrs_' (globals x))) ?p' ?n' \<Longrightarrow> h_t_array_valid (ptr_retyps_gen (Suc 0) p ?arr (hrs_htd (t_hrs_' (globals x)))) ?p' ?n'
h_t_array_valid (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x)))) ?p' ?n' \<Longrightarrow> h_t_array_valid (ptr_retyps_gen 5 (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) ?arr (ptr_retyps_gen 1 p False (hrs_htd (t_hrs_' (globals x))))) ?p' ?n'

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (chain)
picking this:
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> rf_sr proof (prove)
using this:
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> rf_sr

goal (1 subgoal):
 1. cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) proof (prove)
using this:
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> {(s, s'). let cheap = t_hrs_' (globals s') in cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) cheap \<and> cready_queues_relation (clift cheap) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) cheap \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> ptr_span intStateIRQNode_array_Ptr \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> ptr_span armKSGlobalPD_Ptr \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s}

goal (1 subgoal):
 1. cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) proof (state)
this:
cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
using this:
cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x))

goal (1 subgoal):
 1. cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) proof (prove)
using this:
cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr

goal (1 subgoal):
 1. cmap_relation (map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cmap_relation (map_to_eps (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) ep_Ptr (cendpoint_relation (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))))) \<and> cmap_relation (map_to_ntfns (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) ntfn_Ptr (cnotification_relation (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))))) \<and> cmap_relation (map_to_pdes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cpspace_device_data_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cpspace_pde_array_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cpspace_pte_array_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) proof (prove)
goal (1 subgoal):
 1. cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr \<Longrightarrow> cmap_relation (map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cmap_relation (map_to_eps (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) ep_Ptr (cendpoint_relation (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))))) \<and> cmap_relation (map_to_ntfns (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) ntfn_Ptr (cnotification_relation (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))))) \<and> cmap_relation (map_to_pdes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (clift (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cpspace_device_data_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cpspace_pde_array_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) \<and> cpspace_pte_array_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))) proof (prove)
goal (1 subgoal):
 1. cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr \<Longrightarrow> cmap_relation (map_to_ctes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) \<and> cmap_relation (map_to_ntfns (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) \<and> cmap_relation (map_to_pdes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (c_h_t_valid x) pt_Ptr proof (prove)
goal (1 subgoal):
 1. cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr \<Longrightarrow> cmap_relation (\<lambda>x. if x \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) cte_Ptr ccte_relation \<and> cmap_relation ((map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)) ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) \<and> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (\<lambda>x. if x \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) cte_Ptr ccte_relation \<and> cmap_relation ((map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)) ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) \<and> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (\<lambda>x. if x \<in> ptr_val ` (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (CTE capability.NullCap nullMDBNode) else map_to_ctes ks x) (\<lambda>y. if y \<in> (\<lambda>x. cte_Ptr (ctcb_ptr_to_tcb_ptr p + word_of_nat x * word_of_nat (size_of TYPE(cte_C)))) ` {k. k < 5} then Some (from_bytes (replicate (size_of TYPE(cte_C)) 0)) else cslift x y) cte_Ptr ccte_relation
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)) ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) tcb_ptr_to_ctcb_ptr ctcb_relation
 3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))
 4. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ccte_relation (CTE capability.NullCap nullMDBNode) (from_bytes (replicate (size_of TYPE(cte_C)) 0))
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)) ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) tcb_ptr_to_ctcb_ptr ctcb_relation
 3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))
 4. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)) ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))
 3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> map_to_tcbs ks (ctcb_ptr_to_tcb_ptr p) = None
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ctcb_relation makeObject (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))
 3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))
 4. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ks (ctcb_ptr_to_tcb_ptr p) = None
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ctcb_relation makeObject (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))
 3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))
 4. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ctcb_relation makeObject (tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))
 3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))))
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (2 subgoals):
 1. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; map_to_eps ks pa = Some a; map_to_eps ks pa = Some a'; cslift x (ep_Ptr pa) = Some b; cslift x (ep_Ptr pa) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) a b = cendpoint_relation (cslift x) a' b'
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (2 subgoals):
 1. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b\<rbrakk> \<Longrightarrow> (case a of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = (case a of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))))
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (6 subgoals):
 1. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> a = ?endpoint'38 p a a' b b'
 2. \<And>pa a a' b b' x1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; ?endpoint'38 pa a a' b b' = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x1 (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g1.38 pa a a' b b' x1
 3. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; ?endpoint'38 pa a a' b b' = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g2.38 pa a a' b b'
 4. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; ?endpoint'38 pa a a' b b' = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g3.38 pa a a' b b' x3
 5. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (case ?endpoint'38 p a a' b b' of Structures_H.endpoint.RecvEP x \<Rightarrow> ?g1.38 p a a' b b' x | Structures_H.endpoint.IdleEP \<Rightarrow> ?g2.38 p a a' b b' | Structures_H.endpoint.SendEP x \<Rightarrow> ?g3.38 p a a' b b' x) = (case a of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))))
 6. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (5 subgoals):
 1. \<And>pa a a' b b' x1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; a = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x1 (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g1.38 pa a a' b b' x1
 2. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; a = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g2.38 pa a a' b b'
 3. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; a = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g3.38 pa a a' b b' x3
 4. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (case a of Structures_H.endpoint.RecvEP x \<Rightarrow> ?g1.38 p a a' b b' x | Structures_H.endpoint.IdleEP \<Rightarrow> ?g2.38 p a a' b b' | Structures_H.endpoint.SendEP x \<Rightarrow> ?g3.38 p a a' b b' x) = (case a of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))))
 5. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (4 subgoals):
 1. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; a = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g2.38 pa a a' b b'
 2. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; a = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g3.38 pa a a' b b' x3
 3. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (case a of Structures_H.endpoint.RecvEP a \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b') = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) a (tcb_Ptr (epQueue_head_CL (endpoint_lift b'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b'))) | Structures_H.endpoint.IdleEP \<Rightarrow> ?g2.38 p a a' b b' | Structures_H.endpoint.SendEP x \<Rightarrow> ?g3.38 p a a' b b' x) = (case a of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))))
 4. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (3 subgoals):
 1. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks pa = Some a; b' = b; cslift x (ep_Ptr pa) = Some b; a = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> (endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b)))) = ?g3.38 pa a a' b b' x3
 2. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (case a of Structures_H.endpoint.RecvEP a \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b') = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) a (tcb_Ptr (epQueue_head_CL (endpoint_lift b'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b'))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b'))) | Structures_H.endpoint.SendEP x \<Rightarrow> ?g3.38 p a a' b b' x) = (case a of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))))
 3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (2 subgoals):
 1. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_eps ks p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (case a of Structures_H.endpoint.RecvEP a \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b') = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) a (tcb_Ptr (epQueue_head_CL (endpoint_lift b'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b'))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b'))) | Structures_H.endpoint.SendEP a \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b') = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) a (tcb_Ptr (epQueue_head_CL (endpoint_lift b'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b')))) = (case a of Structures_H.endpoint.RecvEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.IdleEP \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))) | Structures_H.endpoint.SendEP q \<Rightarrow> endpoint_CL.state_CL (endpoint_lift b) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (epQueue_head_CL (endpoint_lift b))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift b))))
 2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ks) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))))) proof (prove)
goal (1 subgoal):
 1. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; map_to_ntfns ks pa = Some a; map_to_ntfns ks pa = Some a'; cslift x (ntfn_Ptr pa) = Some b; cslift x (ntfn_Ptr pa) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) a b = cnotification_relation (cslift x) a' b' proof (prove)
goal (1 subgoal):
 1. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b\<rbrakk> \<Longrightarrow> ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) = ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) proof (prove)
goal (5 subgoals):
 1. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ntfnObj a = ?ntfn'54 p a a' b b'
 2. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ?ntfn'54 pa a a' b b' = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g1.54 pa a a' b b'
 3. \<And>pa a a' b b' x2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ?ntfn'54 pa a a' b b' = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> x2 = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g2.54 pa a a' b b' x2
 4. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ?ntfn'54 pa a a' b b' = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g3.54 pa a a' b b' x3
 5. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ((case ?ntfn'54 p a a' b b' of Structures_H.ntfn.IdleNtfn \<Rightarrow> ?g1.54 p a a' b b' | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> ?g2.54 p a a' b b' x | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> ?g3.54 p a a' b b' x) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) = ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) proof (prove)
goal (4 subgoals):
 1. \<And>pa a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ntfnObj a = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g1.54 pa a a' b b'
 2. \<And>pa a a' b b' x2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ntfnObj a = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> x2 = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g2.54 pa a a' b b' x2
 3. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ntfnObj a = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g3.54 pa a a' b b' x3
 4. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> ?g1.54 p a a' b b' | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> ?g2.54 p a a' b b' x | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> ?g3.54 p a a' b b' x) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) = ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) proof (prove)
goal (3 subgoals):
 1. \<And>pa a a' b b' x2. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ntfnObj a = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> x2 = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g2.54 pa a a' b b' x2
 2. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ntfnObj a = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g3.54 pa a a' b b' x3
 3. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b') = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b'))) | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> ?g2.54 p a a' b b' x | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> ?g3.54 p a a' b b' x) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) = ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) proof (prove)
goal (2 subgoals):
 1. \<And>pa a a' b b' x3. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks pa = Some a; b' = b; cslift x (ntfn_Ptr pa) = Some b; ntfnObj a = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> (notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) = ?g3.54 pa a a' b b' x3
 2. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b') = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b'))) | Structures_H.ntfn.ActiveNtfn a \<Rightarrow> notification_CL.state_CL (notification_lift b') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> a = ntfnMsgIdentifier_CL (notification_lift b') \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b'))) | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> ?g3.54 p a a' b b' x) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) = ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) proof (prove)
goal (1 subgoal):
 1. \<And>p a a' b b'. \<lbrakk>cmap_relation (map_to_ctes ks) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs ks) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ks) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes ks) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ks) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ks) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ks (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ks) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ks) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns ks p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b') = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b'))) | Structures_H.ntfn.ActiveNtfn a \<Rightarrow> notification_CL.state_CL (notification_lift b') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> a = ntfnMsgIdentifier_CL (notification_lift b') \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b'))) | Structures_H.ntfn.WaitingNtfn a \<Rightarrow> notification_CL.state_CL (notification_lift b') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) a (tcb_Ptr (ntfnQueue_head_CL (notification_lift b'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b')))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) = ((case ntfnObj a of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift b) \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift b) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift b))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift b)))) \<and> option_to_ctcb_ptr (ntfnBoundTCB a) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift b))) proof (prove)
goal:
No subgoals! proof (state)
this:
cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (state)
this:
cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. cte_array_relation \<sigma> (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>) (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) proof (prove)
using this:
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> rf_sr

goal (1 subgoal):
 1. cte_array_relation \<sigma> (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>) (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_to_tcbs ks) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x))))) \<and> cvariable_array_map_relation ((map_to_tcbs ks)(ctcb_ptr_to_tcb_ptr p \<mapsto> makeObject)) (\<lambda>x. 5) cte_Ptr (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_to_tcbs ks) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> h_t_array_valid (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen (Suc 0) p False (hrs_htd (t_hrs_' (globals x))))) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) 5 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_to_tcbs ks) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> h_t_array_valid (ptr_retyp (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) (ptr_retyp p (hrs_htd (t_hrs_' (globals x))))) (cte_Ptr (ctcb_ptr_to_tcb_ptr p)) 5 proof (prove)
goal:
No subgoals! proof (state)
this:
cte_array_relation \<sigma> (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>) (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (chain)
picking this:
cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))
cte_array_relation \<sigma> (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>) (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) proof (prove)
using this:
cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))
cte_array_relation \<sigma> (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>) (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
using this:
cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))
cte_array_relation \<sigma> (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>) (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x))
(\<sigma>\<lparr>ksPSpace := ks\<rparr>, x) \<in> rf_sr
zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a))) (globals x)))

goal (1 subgoal):
 1. (\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))))); cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) \<and> cvariable_array_map_relation (map_to_tcbs (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))); cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>) \<and> irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)) \<and> cte_array_relation \<sigma> (globals x) \<and> cvariable_array_map_relation (map_to_tcbs ks) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> c_guard intStateIRQNode_array_Ptr \<and> h_t_array_valid (hrs_htd (t_hrs_' (globals x))) intStateIRQNode_Ptr 256 \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> (\<exists>v. cslift x armKSGlobalPD_Ptr = Some v) \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))))\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))))) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) intStateIRQNode_Ptr 256 \<and> (\<exists>v. clift (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))))) armKSGlobalPD_Ptr = Some v) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))))); cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) \<and> cvariable_array_map_relation (map_to_tcbs (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))); cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>) \<and> irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)) \<and> cte_array_relation \<sigma> (globals x) \<and> cvariable_array_map_relation (map_to_tcbs ks) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> c_guard intStateIRQNode_array_Ptr \<and> h_t_array_valid (hrs_htd (t_hrs_' (globals x))) intStateIRQNode_Ptr 256 \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> (\<exists>v. cslift x armKSGlobalPD_Ptr = Some v) \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))))\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) intStateIRQNode_Ptr 256 \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) proof (prove)
goal (1 subgoal):
 1. \<And>v. \<lbrakk>cpspace_relation (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))))); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x)))))); cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))); cvariable_array_map_relation (map_to_tcbs (ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb))) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))); cpspace_relation ks (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); \<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<and> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (qdom, prio)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C qdom prio]))) \<and> ((UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<longrightarrow> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues \<sigma> (qdom, prio) = []); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_to_tcbs ks) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; c_guard intStateIRQNode_array_Ptr; h_t_array_valid (hrs_htd (t_hrs_' (globals x))) intStateIRQNode_Ptr 256; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> (\<forall>qdom prio. UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<and> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' ((cslift x)(p \<mapsto> tcbTimeSlice_C_update (\<lambda>_. 5) (tcbArch_C_update (\<lambda>_. tcbContext_C_update (\<lambda>_. registers_C_update (\<lambda>_. Arrays.update (registers_C (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (unat Kernel_C.CPSR) 0x150) (tcbContext_C (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (tcbArch_C (from_bytes (replicate (size_of TYPE(tcb_C)) 0)))) (from_bytes (replicate (size_of TYPE(tcb_C)) 0))))) (ksReadyQueues \<sigma> (qdom, prio)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C qdom prio]))) \<and> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False) (hrs_htd_update (ptr_retyps_gen (Suc 0) p False) (t_hrs_' (globals x))))) intStateIRQNode_Ptr 256 proof (prove)
goal:
No subgoals! proof (state)
this:
(\<sigma>\<lparr>ksPSpace := ks(ctcb_ptr_to_tcb_ptr p \<mapsto> kotcb)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(p\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(p\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr p)) False (ptr_retyps_gen 1 p False xa)) a)))) x) \<in> rf_sr

goal:
No subgoals!