theory Schedule_C

lemma threadSet_timeSlice_ccorres [corres]:
  "ccorres dc xfdc (tcb_at' thread) {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v} hs
           (threadSet (tcbTimeSlice_update (\<lambda>_. v)) thread)
           (Basic (\<lambda>s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (Ptr &(thread' s\<rightarrow>[''tcbTimeSlice_C''])::word32 ptr) (v' s)))) s))" apply (rule ccorres_guard_imp2) apply (rule threadSet_ccorres_lemma4 [where P=\<top> and P'=\<top>]) apply vcg prefer 2 apply (rule conjI, simp) apply assumption apply clarsimp apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (clarsimp simp: cmachine_state_relation_def carch_state_relation_def cpspace_relation_def) apply (clarsimp simp: update_tcb_map_tos typ_heap_simps') apply (simp add: map_to_ctes_upd_tcb_no_ctes tcb_cte_cases_def
                   map_to_tcbs_upd) apply (simp add: cep_relations_drop_fun_upd cvariable_relation_upd_const
                   ko_at_projectKO_opt) apply (rule conjI) defer apply (erule cready_queues_relation_not_queue_ptrs) apply (rule ext, simp split: if_split) apply (rule ext, simp split: if_split) apply (drule ko_at_projectKO_opt) apply (erule (2) cmap_relation_upd_relI) apply (simp add: ctcb_relation_def) apply assumption apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (tcb_at' thread) {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v} hs (threadSet (tcbTimeSlice_update (\<lambda>_. v)) thread) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>thread'\<rightarrow>[''tcbTimeSlice_C''])) \<acute>v'))) proof (prove)
goal (2 subgoals):
 1. ccorres dc xfdc ?Q ?Q' hs (threadSet (tcbTimeSlice_update (\<lambda>_. v)) thread) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>thread'\<rightarrow>[''tcbTimeSlice_C''])) \<acute>v')))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; tcb_at' thread s; s' \<in> {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v}\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<And>s tcb. \<Gamma>\<turnstile> (?Q3 s tcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>thread'\<rightarrow>[''tcbTimeSlice_C''])) \<acute>v')) {s'. (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> injectKOS (tcbTimeSlice_update (\<lambda>_. v) tcb))\<rparr>, s') \<in> rf_sr}
 2. \<And>s s' tcb tcb'. \<lbrakk>(s, s') \<in> rf_sr; True; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> ?Q'\<rbrakk> \<Longrightarrow> s' \<in> ?Q3 s tcb
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; tcb_at' thread s; s' \<in> {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v}\<rbrakk> \<Longrightarrow> (tcb_at' thread and (\<lambda>_. True)) s \<and> s' \<in> ?Q' proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb tcb'. \<lbrakk>(s, s') \<in> rf_sr; True; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> ?Q'\<rbrakk> \<Longrightarrow> s' \<in> {sa. (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> injectKOS (tcbTimeSlice_update (\<lambda>_. v) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(thread' sa\<rightarrow>[''tcbTimeSlice_C''])) (v' sa)))) sa) \<in> rf_sr}
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; tcb_at' thread s; s' \<in> {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v}\<rbrakk> \<Longrightarrow> (tcb_at' thread and (\<lambda>_. True)) s \<and> s' \<in> ?Q' proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; tcb_at' thread s; s' \<in> {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v}\<rbrakk> \<Longrightarrow> (tcb_at' thread and (\<lambda>_. True)) s \<and> s' \<in> ?Q'
 2. \<And>s s' tcb tcb'. \<lbrakk>(s, s') \<in> rf_sr; True; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> ?Q'\<rbrakk> \<Longrightarrow> s' \<in> {sa. (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> injectKOS (tcbTimeSlice_update (\<lambda>_. v) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(thread' sa\<rightarrow>[''tcbTimeSlice_C''])) (v' sa)))) sa) \<in> rf_sr} proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; tcb_at' thread s; s' \<in> {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v}\<rbrakk> \<Longrightarrow> s' \<in> ?Q'
 2. \<And>s s' tcb tcb'. \<lbrakk>(s, s') \<in> rf_sr; True; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> ?Q'\<rbrakk> \<Longrightarrow> s' \<in> {sa. (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> injectKOS (tcbTimeSlice_update (\<lambda>_. v) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(thread' sa\<rightarrow>[''tcbTimeSlice_C''])) (v' sa)))) sa) \<in> rf_sr} proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>(s, s') \<in> rf_sr; True; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; True; s' \<in> {s. thread' s = tcb_ptr_to_ctcb_ptr thread \<and> unat (v' s) = v}\<rbrakk> \<Longrightarrow> s' \<in> {sa. (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> injectKOS (tcbTimeSlice_update (\<lambda>_. v) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(thread' sa\<rightarrow>[''tcbTimeSlice_C''])) (v' sa)))) sa) \<in> rf_sr} proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>(s, s') \<in> rf_sr; ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s')\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')))) s') \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb))) (underlying_memory (ksMachineState s)) (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))) \<and> carch_state_relation (ksArchState s) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s'))) (globals s')) \<and> cmachine_state_relation (ksMachineState s) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s'))) (globals s')) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ctes ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb))) (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) ep_Ptr (cendpoint_relation (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) ntfn_Ptr (cnotification_relation (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_pdes ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb))) (underlying_memory (ksMachineState s)) (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))) \<and> cpspace_device_data_relation ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb))) (underlying_memory (ksMachineState s)) (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))) \<and> carray_map_relation pdBits (map_to_pdes ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (c_h_t_valid s') pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (c_h_t_valid s') pt_Ptr \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))) \<and> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_mem_update (heap_update (PTR(32 word) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbTimeSlice_C''])) (v' s')) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ctes ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb'))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb'))) \<and> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace s)(thread \<mapsto> KOTCB (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb'))) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb'))) \<and> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> cvariable_array_map_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s) proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) (ksReadyQueues_' (globals s')) (ksReadyQueues s)
 2. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcbSchedNext_C \<circ> (cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb') = map_option tcbSchedNext_C \<circ> cslift s'
 2. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcbSchedPrev_C \<circ> (cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb') = map_option tcbSchedPrev_C \<circ> cslift s'
 3. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcbSchedPrev_C \<circ> (cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb') = map_option tcbSchedPrev_C \<circ> cslift s'
 2. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>ko_at' tcb thread s; cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_tcbs (ksPSpace s) thread = Some tcb\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_tcbs (ksPSpace s))(thread \<mapsto> tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb)) ((cslift s')(tcb_ptr_to_ctcb_ptr thread \<mapsto> tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')) tcb_ptr_to_ctcb_ptr ctcb_relation proof (prove)
goal (3 subgoals):
 1. \<And>s s' tcb tcb'. \<lbrakk>cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_tcbs (ksPSpace s) thread = Some tcb\<rbrakk> \<Longrightarrow> ctcb_relation (tcbTimeSlice_update (\<lambda>_. unat (v' s')) tcb) (tcbTimeSlice_C_update (\<lambda>_. v' s') tcb')
 2. \<And>s s' tcb tcb' x ov ov'. \<lbrakk>cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_tcbs (ksPSpace s) thread = Some tcb; x \<noteq> thread; map_to_tcbs (ksPSpace s) x = Some ov; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ov'; ctcb_relation ov ov'\<rbrakk> \<Longrightarrow> ctcb_relation ov ov'
 3. \<And>s s' tcb tcb'. \<lbrakk>cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_tcbs (ksPSpace s) thread = Some tcb\<rbrakk> \<Longrightarrow> inj tcb_ptr_to_ctcb_ptr proof (prove)
goal (2 subgoals):
 1. \<And>s s' tcb tcb' x ov ov'. \<lbrakk>cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_tcbs (ksPSpace s) thread = Some tcb; x \<noteq> thread; map_to_tcbs (ksPSpace s) x = Some ov; cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ov'; ctcb_relation ov ov'\<rbrakk> \<Longrightarrow> ctcb_relation ov ov'
 2. \<And>s s' tcb tcb'. \<lbrakk>cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_tcbs (ksPSpace s) thread = Some tcb\<rbrakk> \<Longrightarrow> inj tcb_ptr_to_ctcb_ptr proof (prove)
goal (1 subgoal):
 1. \<And>s s' tcb tcb'. \<lbrakk>cslift s' (tcb_ptr_to_ctcb_ptr thread) = Some tcb'; ctcb_relation tcb tcb'; thread' s' = tcb_ptr_to_ctcb_ptr thread; v = unat (v' s'); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; armKSNextASID_' (globals s') = armKSNextASID (ksArchState s); irq_masks (ksMachineState s) = irq_masks (phantom_machine_state_' (globals s')); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState s); irq_state (ksMachineState s) = irq_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState s)) (armKSHWASIDTable_' (globals s')); device_state (ksMachineState s) = device_state (phantom_machine_state_' (globals s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState s)) (armKSASIDTable_' (globals s')); exclusive_state (ksMachineState s) = exclusive_state (phantom_machine_state_' (globals s')); machine_state_rest (ksMachineState s) = machine_state_rest (phantom_machine_state_' (globals s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState s); cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_tcbs (ksPSpace s) thread = Some tcb\<rbrakk> \<Longrightarrow> inj tcb_ptr_to_ctcb_ptr proof (prove)
goal:
No subgoals!