theory IpcCancel_C

lemma state_relation_queue_update_helper':
  "\<lbrakk> (s, s') \<in> rf_sr;
     (\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s)
                                       \<and> distinct (ksReadyQueues s (d, p)));
          globals t = ksReadyQueues_'_update
             (\<lambda>_. Arrays.update (ksReadyQueues_' (globals s')) prio' q')
             (t_hrs_'_update f (globals s'));
          sched_queue_relation' (cslift t) q (head_C q') (end_C q');
          cslift t |` ( - tcb_ptr_to_ctcb_ptr ` S )
             = cslift s' |` ( - tcb_ptr_to_ctcb_ptr ` S );
          option_map tcb_null_sched_ptrs \<circ> cslift t
            = option_map tcb_null_sched_ptrs \<circ> cslift s';
          cslift_all_but_tcb_C t s';
          zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s')))
              = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s'));
          hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s'));
          prio' = cready_queues_index_to_C qdom prio;
          \<forall>x \<in> S. obj_at' (inQ qdom prio) x s
                   \<or> (obj_at' (\<lambda>tcb. tcbPriority tcb = prio) x s
                       \<and> obj_at' (\<lambda>tcb. tcbDomain tcb = qdom) x s)
                   \<or> (tcb_at' x s \<and> (\<forall>d' p'. (d' \<noteq> qdom \<or> p' \<noteq> prio)
                                         \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))));
          S \<noteq> {}; qdom \<le> ucast maxDom; prio \<le> ucast maxPrio \<rbrakk>
      \<Longrightarrow> (s \<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr" apply (subst(asm) disj_imp_rhs) apply (subst obj_at'_and[symmetric]) apply (rule disjI1, erule obj_at'_weakenE, simp add: inQ_def) apply (subst(asm) disj_imp_rhs) apply (subst(asm) obj_at'_and[symmetric]) apply (rule conjI, erule obj_at'_weakenE, simp) apply (rule allI, rule allI) apply (drule_tac x=d' in spec) apply (drule_tac x=p' in spec) apply clarsimp apply (drule(1) bspec) apply (clarsimp simp: inQ_def obj_at'_def) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (intro conjI)
      \<comment> \<open>cpspace_relation\<close> apply (erule nonemptyE, drule(1) bspec) apply (clarsimp simp: cpspace_relation_def) apply (drule obj_at_ko_at', clarsimp) apply (rule cmap_relationE1, assumption,
            erule ko_at_projectKO_opt) apply (frule null_sched_queue) apply (frule null_sched_epD) apply (intro conjI)
       \<comment> \<open>tcb relation\<close> apply (drule ctcb_relation_null_queue_ptrs,
              simp_all)[1]
      \<comment> \<open>endpoint relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (erule cendpoint_relation_upd_tcb_no_queues, simp+)
     \<comment> \<open>ntfn relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (erule cnotification_relation_upd_tcb_no_queues, simp+)
    \<comment> \<open>ready queues\<close> apply (simp add: cready_queues_relation_def Let_def cready_queues_index_to_C_in_range
                     seL4_MinPrio_def minDom_def) apply clarsimp apply (frule cready_queues_index_to_C_distinct, assumption+) apply (clarsimp simp: cready_queues_index_to_C_in_range all_conj_distrib) apply (rule iffD1 [OF tcb_queue_relation'_cong[OF refl], rotated -1],
           drule spec, drule spec, erule mp, simp+) apply clarsimp apply (drule_tac x="tcb_ptr_to_ctcb_ptr x" in fun_cong)+ apply (clarsimp simp: restrict_map_def
                   split: if_split_asm) apply (simp_all add: carch_state_relation_def cmachine_state_relation_def
                        h_t_valid_clift_Some_iff) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. obj_at' (inQ qdom prio) x s \<or> obj_at' (\<lambda>tcb. tcbPriority tcb = prio) x s \<and> obj_at' (\<lambda>tcb. tcbDomain tcb = qdom) x s \<or> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' (inQ qdom prio) x s\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = prio) x s \<and> obj_at' (\<lambda>tcb. tcbDomain tcb = qdom) x s \<or> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. obj_at' (\<lambda>tcb. tcbPriority tcb = prio) x s \<and> obj_at' (\<lambda>tcb. tcbDomain tcb = qdom) x s \<or> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' (inQ qdom prio) x s\<rbrakk> \<Longrightarrow> obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s \<or> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. obj_at' (\<lambda>tcb. tcbPriority tcb = prio) x s \<and> obj_at' (\<lambda>tcb. tcbDomain tcb = qdom) x s \<or> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. obj_at' (\<lambda>tcb. tcbPriority tcb = prio) x s \<and> obj_at' (\<lambda>tcb. tcbDomain tcb = qdom) x s \<or> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' (\<lambda>tcb. tcbPriority tcb = prio) x s \<and> obj_at' (\<lambda>tcb. tcbDomain tcb = qdom) x s\<rbrakk> \<Longrightarrow> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s\<rbrakk> \<Longrightarrow> tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s\<rbrakk> \<Longrightarrow> \<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x d' p'. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s\<rbrakk> \<Longrightarrow> d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x d' p'. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s; \<forall>p. (\<forall>t\<in>set (ksReadyQueues s (d', p)). obj_at' (inQ d' p) t s) \<and> distinct (ksReadyQueues s (d', p))\<rbrakk> \<Longrightarrow> d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x d' p'. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s; (\<forall>t\<in>set (ksReadyQueues s (d', p')). obj_at' (inQ d' p') t s) \<and> distinct (ksReadyQueues s (d', p'))\<rbrakk> \<Longrightarrow> d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x d' p'. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s; clift (f (t_hrs_' (globals s'))) = cslift s'; \<forall>t\<in>set (ksReadyQueues s (d', p')). obj_at' (inQ d' p') t s; distinct (ksReadyQueues s (d', p')); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; d' = qdom \<longrightarrow> p' \<noteq> prio; x \<in> set (ksReadyQueues s (d', p'))\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>x d' p'. \<lbrakk>S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; (s, s') \<in> rf_sr; globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; obj_at' ((\<lambda>tcb. tcbPriority tcb = prio) and (\<lambda>tcb. tcbDomain tcb = qdom)) x s; clift (f (t_hrs_' (globals s'))) = cslift s'; distinct (ksReadyQueues s (d', p')); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; d' = qdom \<longrightarrow> p' \<noteq> prio; x \<in> set (ksReadyQueues s (d', p')); obj_at' (inQ d' p') x s\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s, s') \<in> rf_sr; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) prio' q'\<rparr>; sched_queue_relation' (cslift t) q (head_C q') (StateRelation_C.end_C q'); cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> cslift t = map_option tcb_null_sched_ptrs \<circ> cslift s'; cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s' \<and> cslift t = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))) = zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. d' \<noteq> qdom \<or> p' \<noteq> prio \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> (s\<lparr>ksReadyQueues := (ksReadyQueues s)((qdom, prio) := q)\<rparr>, t) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (f (t_hrs_' (globals s'))) \<and> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q)) \<and> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) \<and> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (f (t_hrs_' (globals s')))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')))\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (f (t_hrs_' (globals s')))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; tcb_at' x s; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cpspace_tcb_relation (ksPSpace s) (f (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (clift (f (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x ko. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s\<rbrakk> \<Longrightarrow> cpspace_tcb_relation (ksPSpace s) (f (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (clift (f (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'\<rbrakk> \<Longrightarrow> cpspace_tcb_relation (ksPSpace s) (f (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (clift (f (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'\<rbrakk> \<Longrightarrow> cpspace_tcb_relation (ksPSpace s) (f (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (clift (f (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cpspace_tcb_relation (ksPSpace s) (f (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (clift (f (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cpspace_tcb_relation (ksPSpace s) (f (t_hrs_' (globals s')))
 2. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (clift (f (t_hrs_' (globals s')))))
 3. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 5. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 6. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (clift (f (t_hrs_' (globals s')))))
 2. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 5. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>x ko y' p a a' b b'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'; map_to_eps (ksPSpace s) p = Some a; map_to_eps (ksPSpace s) p = Some a'; cslift s' (ep_Ptr p) = Some b; cslift s' (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift s') a b = cendpoint_relation (clift (f (t_hrs_' (globals s')))) a' b'
 2. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 5. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>x ko y' p a a' b b'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'; a' = a; map_to_eps (ksPSpace s) p = Some a; b' = b; cslift s' (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift s') a b = cendpoint_relation (clift (f (t_hrs_' (globals s')))) a b
 2. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 5. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x ko y'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (clift (f (t_hrs_' (globals s')))))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x ko y' p a a' b b'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'; map_to_ntfns (ksPSpace s) p = Some a; map_to_ntfns (ksPSpace s) p = Some a'; cslift s' (ntfn_Ptr p) = Some b; cslift s' (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift s') a b = cnotification_relation (clift (f (t_hrs_' (globals s')))) a' b'
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>x ko y' p a a' b b'. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; x \<in> S; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; \<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; ko_at' ko x s; map_to_tcbs (ksPSpace s) x = Some ko; ctcb_relation ko y'; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some y'; map_option tcb_null_queue_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_queue_ptrs \<circ> cslift s'; map_option tcbEPNext_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPNext_C \<circ> cslift s' \<and> map_option tcbEPPrev_C \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcbEPPrev_C \<circ> cslift s'; a' = a; map_to_ntfns (ksPSpace s) p = Some a; b' = b; cslift s' (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift s') a b = cnotification_relation (clift (f (t_hrs_' (globals s')))) a b
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 4. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (f (t_hrs_' (globals s')))) (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q') ((ksReadyQueues s)((qdom, prio) := q))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; \<forall>qdom prio. (qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio]))) \<and> ((qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> \<forall>qdoma prioa. (qdoma = qdom \<longrightarrow> prioa \<noteq> prio) \<longrightarrow> qdoma \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prioa \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (clift (f (t_hrs_' (globals s')))) (ksReadyQueues s (qdoma, prioa)) (head_C (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'.[cready_queues_index_to_C qdoma prioa])) (StateRelation_C.end_C (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'.[cready_queues_index_to_C qdoma prioa]))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<And>qdoma prioa. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; \<forall>qdom prio. (qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio]))) \<and> ((qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; qdoma = qdom \<longrightarrow> prioa \<noteq> prio; qdoma \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prioa \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> sched_queue_relation' (clift (f (t_hrs_' (globals s')))) (ksReadyQueues s (qdoma, prioa)) (head_C (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'.[cready_queues_index_to_C qdoma prioa])) (StateRelation_C.end_C (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'.[cready_queues_index_to_C qdoma prioa]))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<And>qdoma prioa. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; \<forall>qdom prio. (qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio]))) \<and> ((qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; qdoma = qdom \<longrightarrow> prioa \<noteq> prio; qdoma \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prioa \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cready_queues_index_to_C qdoma prioa \<noteq> cready_queues_index_to_C qdom prio\<rbrakk> \<Longrightarrow> sched_queue_relation' (clift (f (t_hrs_' (globals s')))) (ksReadyQueues s (qdoma, prioa)) (head_C (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'.[cready_queues_index_to_C qdoma prioa])) (StateRelation_C.end_C (Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'.[cready_queues_index_to_C qdoma prioa]))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<And>qdoma prioa. \<lbrakk>globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; qdoma = qdom \<longrightarrow> prioa \<noteq> prio; qdoma \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prioa \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cready_queues_index_to_C qdoma prioa \<noteq> cready_queues_index_to_C qdom prio; \<forall>d p. \<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s; \<forall>d p. distinct (ksReadyQueues s (d, p)); \<forall>qdom prio. qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])); \<forall>qdom prio. (qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []\<rbrakk> \<Longrightarrow> sched_queue_relation' (clift (f (t_hrs_' (globals s')))) (ksReadyQueues s (qdoma, prioa)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdoma prioa])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdoma prioa]))
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<And>qdoma prioa p. \<lbrakk>globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; qdoma = qdom \<longrightarrow> prioa \<noteq> prio; qdoma \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prioa \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cready_queues_index_to_C qdoma prioa \<noteq> cready_queues_index_to_C qdom prio; \<forall>d p. \<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s; \<forall>d p. distinct (ksReadyQueues s (d, p)); \<forall>qdom prio. qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])); \<forall>qdom prio. (qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; p \<in> tcb_ptr_to_ctcb_ptr ` set (ksReadyQueues s (qdoma, prioa))\<rbrakk> \<Longrightarrow> cslift s' p = clift (f (t_hrs_' (globals s'))) p
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<And>qdoma prioa x. \<lbrakk>globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; qdoma = qdom \<longrightarrow> prioa \<noteq> prio; qdoma \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prioa \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cready_queues_index_to_C qdoma prioa \<noteq> cready_queues_index_to_C qdom prio; \<forall>d p. \<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s; \<forall>d p. distinct (ksReadyQueues s (d, p)); \<forall>qdom prio. qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])); \<forall>qdom prio. (qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; x \<in> set (ksReadyQueues s (qdoma, prioa))\<rbrakk> \<Longrightarrow> cslift s' (tcb_ptr_to_ctcb_ptr x) = clift (f (t_hrs_' (globals s'))) (tcb_ptr_to_ctcb_ptr x)
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<And>qdoma prioa x. \<lbrakk>globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; qdoma = qdom \<longrightarrow> prioa \<noteq> prio; qdoma \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prioa \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cready_queues_index_to_C qdoma prioa \<noteq> cready_queues_index_to_C qdom prio; \<forall>d p. \<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s; \<forall>d p. distinct (ksReadyQueues s (d, p)); \<forall>qdom prio. qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])); \<forall>qdom prio. (qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; x \<in> set (ksReadyQueues s (qdoma, prioa)); (clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>) (tcb_ptr_to_ctcb_ptr x) = (cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>) (tcb_ptr_to_ctcb_ptr x); (map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s')))) (tcb_ptr_to_ctcb_ptr x) = (map_option tcb_null_sched_ptrs \<circ> cslift s') (tcb_ptr_to_ctcb_ptr x)\<rbrakk> \<Longrightarrow> cslift s' (tcb_ptr_to_ctcb_ptr x) = clift (f (t_hrs_' (globals s'))) (tcb_ptr_to_ctcb_ptr x)
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 3. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>)
 2. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p) t s) \<and> distinct (ksReadyQueues s (d, p)); globals t = t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>; sched_queue_relation' (clift (f (t_hrs_' (globals s')))) q (head_C q') (StateRelation_C.end_C q'); clift (f (t_hrs_' (globals s')))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub> = cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` S)\<^esub>; map_option tcb_null_sched_ptrs \<circ> clift (f (t_hrs_' (globals s'))) = map_option tcb_null_sched_ptrs \<circ> cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (f (t_hrs_' (globals s'))); hrs_htd (f (t_hrs_' (globals s'))) = hrs_htd (t_hrs_' (globals s')); prio' = cready_queues_index_to_C qdom prio; \<forall>x\<in>S. tcb_at' x s \<and> (\<forall>d' p'. (d' = qdom \<longrightarrow> p' \<noteq> prio) \<longrightarrow> x \<notin> set (ksReadyQueues s (d', p'))); S \<noteq> {}; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); clift (f (t_hrs_' (globals s'))) = cslift s'; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); clift (f (t_hrs_' (globals s'))) = cslift s'; clift (f (t_hrs_' (globals s'))) = cslift s'; cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState s) (t_hrs_'_update f (globals s')\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s')) (cready_queues_index_to_C qdom prio) q'\<rparr>) proof (prove)
goal:
No subgoals!