theory IpcCancel_C

lemma tcbSchedAppend_ccorres:
  "ccorres dc xfdc
           (valid_queues and tcb_at' t and valid_objs')
           (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>)
           []
           (tcbSchedAppend t)
           (Call tcbSchedAppend_'proc)" proof - note prio_and_dom_limit_helpers[simp] word_sle_def[simp] maxDom_to_H[simp] maxPrio_to_H[simp] 

  (* when numDomains = 1, array bounds checks would become _ = 0 rather than _ < 1, changing the
     shape of the proof compared to when numDomains > 1 *)
   include no_less_1_simps show ?thesis apply (cinit lift: tcb_') apply (rule_tac r'="\<lambda>rv rv'. rv = to_bool rv'"
               and xf'="ret__unsigned_'" in ccorres_split_nothrow) apply (rule threadGet_vcg_corres) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (drule obj_at_ko_at', clarsimp) apply (drule spec, drule(1) mp, clarsimp) apply (clarsimp simp: typ_heap_simps ctcb_relation_def) apply ceqv apply (simp add: when_def unless_def del: Collect_const split del: if_split) apply (rule ccorres_cond[where R=\<top>]) apply (simp add: to_bool_def) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply (rule_tac r'="\<lambda>rv rv'. rv' = ucast rv"
          and xf'="dom_'" in ccorres_split_nothrow) apply (rule threadGet_vcg_corres) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (drule obj_at_ko_at', clarsimp) apply (drule spec, drule(1) mp, clarsimp) apply (clarsimp simp: typ_heap_simps ctcb_relation_def) apply ceqv apply (rule_tac r'="\<lambda>rv rv'. rv' = ucast rv"
            and xf'="prio_'" in ccorres_split_nothrow) apply (rule threadGet_vcg_corres) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (drule obj_at_ko_at', clarsimp) apply (drule spec, drule(1) mp, clarsimp) apply (clarsimp simp: typ_heap_simps ctcb_relation_def) apply ceqv apply (rule ccorres_rhs_assoc2)+ apply (simp only: bind_assoc[symmetric]) apply (rule ccorres_split_nothrow_novcg_dc) prefer 2 apply (rule ccorres_move_c_guard_tcb) apply ctac prefer 2 apply (wp, clarsimp, wp+) apply (rule_tac P="\<lambda>s. valid_queues s \<and> (\<forall>p. t \<notin> set (ksReadyQueues s p))
                                  \<and> (\<exists>tcb. ko_at' tcb t s \<and> tcbDomain tcb =rva
                                  \<and> tcbPriority tcb = rvb \<and> valid_tcb' tcb s)"
                       and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: getQueue_def gets_def get_def setQueue_def modify_def
                                 put_def bind_def return_def bitmap_fun_defs null_def) apply (clarsimp simp: queue_in_range valid_tcb'_def) apply (rule conjI; clarsimp simp: queue_in_range) apply (drule (1) obj_at_cslift_tcb) apply clarsimp apply (frule_tac d="tcbDomain tcb" and p="tcbPriority tcb"
                     in rf_sr_sched_queue_relation) apply clarsimp apply clarsimp apply (frule_tac s=\<sigma> in tcb_queue'_head_end_NULL) apply (simp add: valid_queues_valid_q) apply (frule_tac s=\<sigma> in tcb_queue_relation_qend_mems,  simp add: valid_queues_valid_q) apply (drule_tac qend'="tcb_ptr_to_ctcb_ptr t" and s=\<sigma> in tcbSchedAppend_update,
                   simp_all add: valid_queues_valid_q)[1] apply (rule tcb_at_not_NULL, erule obj_at'_weakenE, simp) apply (clarsimp simp: h_val_field_clift' h_t_valid_clift) apply (simp add: invert_prioToL1Index_c_simp) apply (rule conjI, solves \<open>clarsimp simp: le_maxDomain_eq_less_numDomains
                                                      unat_trans_ucast_helper\<close>) apply (clarsimp simp: maxDomain_le_unat_ucast_explicit) apply (rule conjI; clarsimp) apply (rule conjI) apply (fastforce simp: c_invert_assist l2BitmapSize_def' wordRadix_def) apply (simp add: t_hrs_ksReadyQueues_upd_absorb) apply (subst rf_sr_drop_bitmaps_enqueue_helper, assumption) apply (fastforce intro: cbitmap_L1_relation_bit_set) subgoal by (fastforce intro: cbitmap_L2_relation_bit_set simp: wordRadix_def mask_def) apply (erule(1) state_relation_queue_update_helper[where S="{t}"],
                    (simp | rule globals.equality)+,
                    simp_all add: cready_queues_index_to_C_def2 numPriorities_def
                                  t_hrs_ksReadyQueues_upd_absorb upd_unless_null_def
                                  typ_heap_simps)[1] apply (fastforce simp: tcb_null_sched_ptrs_def elim: obj_at'_weaken)+ apply (clarsimp simp: upd_unless_null_def cready_queues_index_to_C_def numPriorities_def) apply (rule conjI, solves \<open>clarsimp simp: le_maxDomain_eq_less_numDomains
                                                     unat_trans_ucast_helper\<close>) apply (clarsimp simp: maxDomain_le_unat_ucast_explicit) apply (rule conjI; clarsimp simp: queue_in_range) apply (drule (1) obj_at_cslift_tcb) apply clarsimp apply (frule_tac d="tcbDomain tcb" and p="tcbPriority tcb"
                     in rf_sr_sched_queue_relation) apply clarsimp apply clarsimp apply (frule_tac s=\<sigma> in tcb_queue'_head_end_NULL) apply (simp add: valid_queues_valid_q) apply (frule_tac s=\<sigma> in tcb_queue_relation_qend_mems,
                   simp add: valid_queues_valid_q) apply (drule_tac qend'="tcb_ptr_to_ctcb_ptr t" and s=\<sigma> in tcbSchedAppend_update,
                   simp_all add: valid_queues_valid_q)[1] apply clarsimp apply (rule tcb_at_not_NULL, erule obj_at'_weakenE, simp) apply (clarsimp simp: h_val_field_clift' h_t_valid_clift) apply (clarsimp simp: upd_unless_null_def cready_queues_index_to_C_def numPriorities_def) apply (drule (1) obj_at_cslift_tcb) apply clarsimp apply (frule_tac d="tcbDomain tcb" and p="tcbPriority tcb"
                    in rf_sr_sched_queue_relation) apply clarsimp apply clarsimp apply (frule_tac s=\<sigma> in tcb_queue'_head_end_NULL) apply (simp add: valid_queues_valid_q) apply (frule_tac s=\<sigma> in tcb_queue_relation_qend_mems,
                  simp add: valid_queues_valid_q) apply (drule_tac qend'="tcb_ptr_to_ctcb_ptr t" and s=\<sigma> in tcbSchedAppend_update,
                  simp_all add: valid_queues_valid_q)[1] apply clarsimp apply (rule tcb_at_not_NULL, erule obj_at'_weakenE, simp) apply (clarsimp simp: cready_queues_index_to_C_def2 numPriorities_def) apply (frule(2) obj_at_cslift_tcb[OF valid_queues_obj_at'D]) apply (clarsimp simp: h_val_field_clift' h_t_valid_clift) apply (erule_tac S="{t, v}" for v in state_relation_queue_update_helper,
                  (simp | rule globals.equality)+,
                  simp_all add: typ_heap_simps if_Some_helper numPriorities_def
                                cready_queues_index_to_C_def2 upd_unless_null_def
                           cong: if_cong split del: if_split
                           del: fun_upd_restrict_conv)[1] apply simp apply (rule conjI) apply clarsimp apply (drule_tac s="tcb_ptr_to_ctcb_ptr t" in sym, simp) apply (clarsimp simp add: fun_upd_twist) prefer 3 apply (simp add: obj_at'_weakenE[OF _ TrueI]) apply (rule disjI1, erule valid_queues_obj_at'D) subgoal by simp subgoal by simp subgoal by (fastforce simp: tcb_null_sched_ptrs_def) apply (simp add: guard_is_UNIV_def) apply simp apply (wp threadGet_wp) apply vcg apply simp apply (wp threadGet_wp) apply vcg apply (rule ccorres_return_Skip) apply simp apply (wp threadGet_wp) apply vcg by (fastforce simp: valid_objs'_def obj_at'_def ran_def projectKOs typ_at'_def
                         valid_obj'_def inQ_def
                   dest!: valid_queues_obj_at'D) qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (Invariants_H.valid_queues and tcb_at' t and valid_objs') (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (tcbSchedAppend t) (Call tcbSchedAppend_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (Invariants_H.valid_queues and tcb_at' t and valid_objs') (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (tcbSchedAppend t) (Call tcbSchedAppend_'proc) proof (state)
this:
UCAST(8 \<rightarrow> 32) ?p >> wordRadix < 8
UCAST(8 \<rightarrow> 32) ?p >> wordRadix \<le> 7
UCAST(8 \<rightarrow> 32) ?p >> wordRadix < 0x20
unat (?p >> wordRadix) \<le> 7
unat (UCAST(8 \<rightarrow> 32) ?d * 0x100 + UCAST(8 \<rightarrow> 32) ?p) = unat ?d * 256 + unat ?p
unat (UCAST(8 \<rightarrow> 32) ?p && 0x1F) = unat (?p && 0x1F)
?w && 0x1F < 0x20
(?a \<le>s ?b) = (sint ?a \<le> sint ?b)
UCAST(32 signed \<rightarrow> 8) maxDom = maxDomain
UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio = maxPriority

goal (1 subgoal):
 1. ccorres dc xfdc (Invariants_H.valid_queues and tcb_at' t and valid_objs') (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (tcbSchedAppend t) (Call tcbSchedAppend_'proc) proof (state)
this:
UCAST(8 \<rightarrow> 32) ?p >> wordRadix < 8
UCAST(8 \<rightarrow> 32) ?p >> wordRadix \<le> 7
UCAST(8 \<rightarrow> 32) ?p >> wordRadix < 0x20
unat (?p >> wordRadix) \<le> 7
unat (UCAST(8 \<rightarrow> 32) ?d * 0x100 + UCAST(8 \<rightarrow> 32) ?p) = unat ?d * 256 + unat ?p
unat (UCAST(8 \<rightarrow> 32) ?p && 0x1F) = unat (?p && 0x1F)
?w && 0x1F < 0x20
(?a \<le>s ?b) = (sint ?a \<le> sint ?b)
UCAST(32 signed \<rightarrow> 8) maxDom = maxDomain
UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio = maxPriority

goal (1 subgoal):
 1. ccorres dc xfdc (Invariants_H.valid_queues and tcb_at' t and valid_objs') (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (tcbSchedAppend t) (Call tcbSchedAppend_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (Invariants_H.valid_queues and tcb_at' t and valid_objs') (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (tcbSchedAppend t) (Call tcbSchedAppend_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (Invariants_H.valid_queues and tcb_at' t and valid_objs') (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (tcbSchedAppend t) (Call tcbSchedAppend_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ccorres dc xfdc (?Q415 tcb) (?Q'415 tcb) [SKIP] (do queued <- threadGet tcbQueued t;
unless queued (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']))));;
IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q415 tcb s \<and> s' \<in> ?Q'415 tcb proof (prove)
goal (6 subgoals):
 1. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ccorres (\<lambda>rv rv'. rv = to_bool rv') ret__unsigned_' (?P421 tcb) (?P'421 tcb) [SKIP] (threadGet tcbQueued t) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))))
 2. \<And>tcb rv' ta t'. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?d'421 tcb rv')
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (?d'421 tcb rv')
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P421 tcb and ?R421 tcb) s \<and> s' \<in> ?P'421 tcb \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>tcb x. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' t \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbQueued tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'))} Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. (\<sigma>, s) \<in> rf_sr \<and> x = to_bool (ret__unsigned_' s)}
 2. \<And>tcb rv' ta t'. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?d'421 tcb rv')
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (?d'421 tcb rv')
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>tcb x \<sigma>. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' t \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbQueued tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'))} \<subseteq> {s. s \<Turnstile>\<^sub>c tcb \<and> (\<forall>t. ret__unsigned_' t = tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']))))\<rparr>) \<in> rf_sr \<and> x = to_bool (tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']))))))}
 2. \<And>tcb rv' ta t'. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?d'421 tcb rv')
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (?d'421 tcb rv')
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>x \<sigma> xa. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; tcb_at' t \<sigma>; \<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> x = tcbQueued tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb')\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> ((\<exists>ta. ret__unsigned_' ta = tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> x = to_bool (tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']))))))
 2. \<And>tcb rv' ta t'. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?d'421 tcb rv')
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (?d'421 tcb rv')
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>x \<sigma> xa ko. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; \<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> x = tcbQueued tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'); ko_at' ko t \<sigma>\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> ((\<exists>ta. ret__unsigned_' ta = tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']))))))
 2. \<And>tcb rv' ta t'. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?d'421 tcb rv')
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (?d'421 tcb rv')
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> xa ko tcb'. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; ko_at' ko t \<sigma>; cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb'; ctcb_relation ko tcb'\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> ((\<exists>ta. ret__unsigned_' ta = tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']))))) \<longrightarrow> tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']))))))
 2. \<And>tcb rv' ta t'. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?d'421 tcb rv')
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (?d'421 tcb rv')
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv' ta t'. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' ta t' (IF \<acute>ret__unsigned = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI) (?d'421 tcb rv')
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (?d'421 tcb rv')
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (4 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 tcb rv) (?Q'421 tcb rv rv') [SKIP] (unless rv (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- when (null queue) (addToBitmap tdom prio);
threadSet (tcbQueued_update (\<lambda>_. True)) t
od)) (IF rv' = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc(\<acute>dom,\<acute>prio);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb) \<acute>queue;;
CALL addToBitmap_'proc(SCAST(32 signed \<rightarrow> 32) 0,\<acute>dom,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) tcb)))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 4. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (4 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q421 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Q'421 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (if \<not> to_bool rv' then do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od else return ()) (IF rv' = 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc();;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
FI)
 2. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>?Q421 tcb\<rbrace>
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Q'421 tcb rv (ret__unsigned_' s)}
 4. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (\<not> to_bool rv') = (s' \<in> \<lbrace>rv' = 0\<rbrace>)
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt820 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rt813 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc();;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pt820 tcb a s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Rt813 tcb rv (ret__unsigned_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt820 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rt813 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dom_' dom_'_update;;
lvar_nondet_init prio_' prio_'_update;;
lvar_nondet_init idx_' idx_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
\<acute>idx :== CALL ready_queues_index_'proc();;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pt820 tcb a s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Rt813 tcb rv (ret__unsigned_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt820 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rt813 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (lvar_nondet_init queue_' queue_'_update;;
(lvar_nondet_init dom_' dom_'_update;;
(lvar_nondet_init prio_' prio_'_update;;
(lvar_nondet_init idx_' idx_'_update;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))))))))
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pt820 tcb a s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> ?Rt813 tcb rv (ret__unsigned_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt820 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?G'884 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (lvar_nondet_init dom_' dom_'_update;;
(lvar_nondet_init prio_' prio_'_update;;
(lvar_nondet_init idx_' idx_'_update;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))))))))
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pt820 tcb a s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> ?G'884 tcb rv (ret__unsigned_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt820 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?G'903 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (lvar_nondet_init prio_' prio_'_update;;
(lvar_nondet_init idx_' idx_'_update;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))))))
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pt820 tcb a s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> ?G'903 tcb rv (ret__unsigned_' s)}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt820 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?G'922 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (lvar_nondet_init idx_' idx_'_update;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))))))
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pt820 tcb a s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> ?G'922 tcb rv (ret__unsigned_' s)}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt820 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?G'941 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (do tdom <- threadGet tcbDomain t;
prio <- threadGet tcbPriority t;
queue <- getQueue tdom prio;
y <- setQueue tdom prio (queue @ [t]);
y <- if null queue then addToBitmap tdom prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))))
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ?Pt820 tcb a s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> ?G'941 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = UCAST(8 \<rightarrow> 32) rv) dom_' (?P963 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?P'956 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (threadGet tcbDomain t) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))))
 2. \<And>tcb rv rv' rv'a ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dom_' rv'a ta t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))) (?d'953 tcb rv rv' rv'a)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'953 tcb rv rv' rv'a)
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> (?P963 tcb a and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> ?P'956 tcb rv (ret__unsigned_' s) \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>tcb rv rv' x. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' t \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbDomain tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'))} Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. (\<sigma>, s) \<in> rf_sr \<and> dom_' s = UCAST(8 \<rightarrow> 32) x}
 2. \<And>tcb rv rv' rv'a ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dom_' rv'a ta t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))) (?d'953 tcb rv rv' rv'a)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'953 tcb rv rv' rv'a)
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>tcb rv rv' x \<sigma>. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' t \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbDomain tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'))} \<subseteq> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>, dom_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) s) \<in> rf_sr \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])) = UCAST(8 \<rightarrow> 32) x}
 2. \<And>tcb rv rv' rv'a ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dom_' rv'a ta t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))) (?d'953 tcb rv rv' rv'a)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'953 tcb rv rv' rv'a)
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>x \<sigma> xa. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; tcb_at' t \<sigma>; \<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> x = tcbDomain tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb')\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])) = UCAST(8 \<rightarrow> 32) x
 2. \<And>tcb rv rv' rv'a ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dom_' rv'a ta t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))) (?d'953 tcb rv rv' rv'a)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'953 tcb rv rv' rv'a)
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>x \<sigma> xa ko. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; \<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> x = tcbDomain tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'); ko_at' ko t \<sigma>\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])) = UCAST(8 \<rightarrow> 32) (tcbDomain ko)
 2. \<And>tcb rv rv' rv'a ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dom_' rv'a ta t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))) (?d'953 tcb rv rv' rv'a)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'953 tcb rv rv' rv'a)
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> xa ko tcb'. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; ko_at' ko t \<sigma>; cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb'; ctcb_relation ko tcb'\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C''])) = UCAST(8 \<rightarrow> 32) (tcbDomain ko)
 2. \<And>tcb rv rv' rv'a ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dom_' rv'a ta t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))) (?d'953 tcb rv rv' rv'a)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'953 tcb rv rv' rv'a)
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (8 subgoals):
 1. \<And>tcb rv rv' rv'a ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dom_' rv'a ta t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc();;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))) (?d'953 tcb rv rv' rv'a)
 2. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'953 tcb rv rv' rv'a)
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 6. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 8. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (7 subgoals):
 1. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q953 tcb rv rv' rva) (?Q'953 tcb rv rv' rva rv'a) [SKIP] (do prio <- threadGet tcbPriority t;
queue <- getQueue rva prio;
y <- setQueue rva prio (queue @ [t]);
y <- if null queue then addToBitmap rva prio else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])));;
(\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))))
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>?Q953 tcb rv rv'\<rbrace>
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?Q'953 tcb rv rv' rva (dom_' s)}
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 6. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 7. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (11 subgoals):
 1. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = UCAST(8 \<rightarrow> 32) rv) prio_' (?P1250 tcb rv rv' rva) (?P'1248 tcb rv rv' rva rv'a) [SKIP] (threadGet tcbPriority t) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))))
 2. \<And>tcb rv rv' rva rv'a rv'b ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prio_' rv'b ta t' (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))) (?d'1248 tcb rv rv' rva rv'a rv'b)
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'1248 tcb rv rv' rva rv'a rv'b)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. ?P1250 tcb rv rv' rva and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> ?P'1248 tcb rv rv' rva (dom_' s) \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tcb rv rv' rva rv'a x. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' t \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbPriority tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'))} Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. (\<sigma>, s) \<in> rf_sr \<and> prio_' s = UCAST(8 \<rightarrow> 32) x}
 2. \<And>tcb rv rv' rva rv'a rv'b ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prio_' rv'b ta t' (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))) (?d'1248 tcb rv rv' rva rv'a rv'b)
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'1248 tcb rv rv' rva rv'a rv'b)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tcb rv rv' rva rv'a x \<sigma>. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> tcb_at' t \<sigma> \<and> True \<and> (\<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> (\<exists>tcb'. x = tcbPriority tcb \<and> cslift s (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'))} \<subseteq> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>, prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) s) \<in> rf_sr \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) x}
 2. \<And>tcb rv rv' rva rv'a rv'b ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prio_' rv'b ta t' (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))) (?d'1248 tcb rv rv' rva rv'a rv'b)
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'1248 tcb rv rv' rva rv'a rv'b)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x \<sigma> xa. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; tcb_at' t \<sigma>; \<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> x = tcbPriority tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb')\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) x
 2. \<And>tcb rv rv' rva rv'a rv'b ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prio_' rv'b ta t' (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))) (?d'1248 tcb rv rv' rva rv'a rv'b)
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'1248 tcb rv rv' rva rv'a rv'b)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x \<sigma> xa ko. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; \<forall>tcb. ko_at' tcb t \<sigma> \<longrightarrow> x = tcbPriority tcb \<and> (\<exists>tcb'. cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb' \<and> ctcb_relation tcb tcb'); ko_at' ko t \<sigma>\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority ko)
 2. \<And>tcb rv rv' rva rv'a rv'b ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prio_' rv'b ta t' (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))) (?d'1248 tcb rv rv' rva rv'a rv'b)
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'1248 tcb rv rv' rva rv'a rv'b)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> xa ko tcb'. \<lbrakk>(\<sigma>, xa) \<in> rf_sr; ko_at' ko t \<sigma>; cslift xa (tcb_ptr_to_ctcb_ptr t) = Some tcb'; ctcb_relation ko tcb'\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> h_val (hrs_mem (t_hrs_' (globals xa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority ko)
 2. \<And>tcb rv rv' rva rv'a rv'b ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prio_' rv'b ta t' (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))) (?d'1248 tcb rv rv' rva rv'a rv'b)
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'1248 tcb rv rv' rva rv'a rv'b)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>tcb rv rv' rva rv'a rv'b ta t'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> prio_' rv'b ta t' (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,\<acute>prio);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,\<acute>prio)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))))))))) (?d'1248 tcb rv rv' rva rv'a rv'b)
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (?d'1248 tcb rv rv' rva rv'a rv'b)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,rv'b);;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
(IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,rv'b)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
(\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
(Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))))))))
 2. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 tcb rv rv' rva rv'a rvb) (?Q'1248 tcb rv rv' rva rv'a rvb rv'b) [SKIP] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
y <- if null queue then addToBitmap rva rvb else return ();
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (\<acute>idx :== CALL ready_queues_index_'proc(rv'a,rv'b);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,rv'a,rv'b)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 2. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (9 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb) (?Q'1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb (UCAST(8 \<rightarrow> 32) rvb)) [SKIP] (do y <- do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od;
threadSet (tcbQueued_update (\<lambda>_. True)) t
od) (\<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 2. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>?Q1248 tcb rv rv' rva rv'a\<rbrace>
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (12 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1534 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb) (?Q'1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb (UCAST(8 \<rightarrow> 32) rvb)) [] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) (\<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue))
 2. \<And>tcb rv rv' rva rv'a rvb rv'b rvc rv'c. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb; dc rvc rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1528 tcb rv rv' rva rv'a rvb rv'b rvc) (?Q'1528 tcb rv rv' rva rv'a rvb rv'b rvc rv'c) [SKIP] (threadSet (tcbQueued_update (\<lambda>_. True)) t) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb\<rbrace> do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od \<lbrace>?Q1528 tcb rv rv' rva rv'a rvb rv'b\<rbrace>
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1528 tcb rv rv' rva rv'a rvb rv'b)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. ?P1534 tcb rv rv' rva rv'a a and ?R1532 tcb rv rv' rva rv'a a\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b rvc rv'c. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb; dc rvc rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1528 tcb rv rv' rva rv'a rvb rv'b rvc) (?Q'1528 tcb rv rv' rva rv'a rvb rv'b rvc rv'c) [SKIP] (threadSet (tcbQueued_update (\<lambda>_. True)) t) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true)))
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1534 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb) (?Q'1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb (UCAST(8 \<rightarrow> 32) rvb)) [] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) (\<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb\<rbrace> do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od \<lbrace>?Q1528 tcb rv rv' rva rv'a rvb rv'b\<rbrace>
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1528 tcb rv rv' rva rv'a rvb rv'b)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. ?P1534 tcb rv rv' rva rv'a a and ?R1532 tcb rv rv' rva rv'a a\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b rvc rv'c. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb; dc rvc rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1541 tcb rv rv' rva rv'a rvb rv'b rvc) (?C'1540 tcb rv rv' rva rv'a rvb rv'b rvc rv'c) [SKIP] (threadSet (tcbQueued_update (\<lambda>_. True)) t) (CALL thread_state_ptr_set_tcbQueued_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) true))
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1534 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb) (?Q'1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb (UCAST(8 \<rightarrow> 32) rvb)) [] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) (\<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb\<rbrace> do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od \<lbrace>\<lambda>rvc. ?A1541 tcb rv rv' rva rv'a rvb rv'b rvc and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr t))\<rbrace>
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. ?C'1540 tcb rv rv' rva rv'a rvb rv'b rvc rv'c \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. ?P1534 tcb rv rv' rva rv'a a and ?R1532 tcb rv rv' rva rv'a a\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1534 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb) (?Q'1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb (UCAST(8 \<rightarrow> 32) rvb)) [] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) (\<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue))
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb\<rbrace> do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od \<lbrace>\<lambda>rvc. tcb_at' t and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr t))\<rbrace>
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. ?P1534 tcb rv rv' rva rv'a a and ?R1532 tcb rv rv' rva rv'a a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R1532 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb\<rbrace> do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od \<lbrace>\<lambda>rvc. tcb_at' t and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr t))\<rbrace>
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1534 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb) (?Q'1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb (UCAST(8 \<rightarrow> 32) rvb)) [] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) (\<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. ?P1534 tcb rv rv' rva rv'a a and ?R1532 tcb rv rv' rva rv'a a\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1534 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb) (?Q'1248 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva (UCAST(8 \<rightarrow> 32) rva) rvb (UCAST(8 \<rightarrow> 32) rvb)) [] (do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) (\<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue))
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. ?P1534 tcb rv rv' rva rv'a a and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rvb. prio_' s = UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> s \<in> ?Q'1248 tcb rv rv' rva rv'a rvb (prio_' s)}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (Invariants_H.valid_queues \<sigma> \<and> (\<forall>p. t \<notin> set (ksReadyQueues \<sigma> p)) \<and> (\<exists>tcb. ko_at' tcb t \<sigma> \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = rvb \<and> valid_tcb' tcb \<sigma>)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>idx :== CALL ready_queues_index_'proc(UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb);;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>queue :== \<acute>ksReadyQueues.[unat \<acute>idx]);;
IF head_C \<acute>queue = NULL THEN
  \<acute>queue :== head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
CALL addToBitmap_'proc(0,UCAST(8 \<rightarrow> 32) rva,UCAST(8 \<rightarrow> 32) rvb)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c StateRelation_C.end_C (queue_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C \<acute>queue\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t))))
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C \<acute>queue))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL)));;
\<acute>queue :== tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) \<acute>queue;;
Guard ArrayBounds \<lbrace>\<acute>idx < 0x1000\<rbrace> (\<acute>ksReadyQueues :== Arrays.update \<acute>ksReadyQueues (unat \<acute>idx) \<acute>queue) {s. \<exists>(rv, \<sigma>')\<in>fst ((do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b \<sigma>. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> {s. (Invariants_H.valid_queues \<sigma> \<and> (\<forall>p. t \<notin> set (ksReadyQueues \<sigma> p)) \<and> (\<exists>tcb. ko_at' tcb t \<sigma> \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = rvb \<and> valid_tcb' tcb \<sigma>)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (numDomains \<le> 1 \<longrightarrow> UCAST(8 \<rightarrow> 32) rva = 0) \<and> (\<forall>ta. ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb \<longrightarrow> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (head_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]) = NULL \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) rvb >> wordRadix \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva < SCAST(32 signed \<rightarrow> 32) 0x10 \<and> UCAST(8 \<rightarrow> 32) rvb >> wordRadix < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> UCAST(8 \<rightarrow> 32) rva < SCAST(32 signed \<rightarrow> 32) 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < SCAST(32 signed \<rightarrow> 32) 8 \<and> UCAST(8 \<rightarrow> 32) rva < SCAST(32 signed \<rightarrow> 32) 0x10 \<and> UCAST(8 \<rightarrow> 32) rvb && (1 << unat 5) - 1 < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> 0 \<le>s 5 \<and> 5 <s 0x20 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < SCAST(32 signed \<rightarrow> 32) 8 \<and> UCAST(8 \<rightarrow> 32) rva < SCAST(32 signed \<rightarrow> 32) 0x10 \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])))) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<exists>(rv, \<sigma>')\<in>fst ((do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) \<sigma>). (\<sigma>', s\<lparr>idx_' := UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb, queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])))) x)) (globals s\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva)) (ksReadyQueuesL1Bitmap_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva)] || (1 << unat (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))] || (1 << unat (UCAST(8 \<rightarrow> 32) rvb && (1 << unat 5) - 1))))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])))\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>idx_' := UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb, queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])))) x)) (globals s\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva)) (ksReadyQueuesL1Bitmap_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva)] || (1 << unat (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))] || (1 << unat (UCAST(8 \<rightarrow> 32) rvb && (1 << unat 5) - 1))))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])))\<rparr>\<rparr>)))))) \<and> (head_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]) \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr t \<and> hrs_htd (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) (t_hrs_' (globals s)))) \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<exists>(rv, \<sigma>')\<in>fst ((do queue <- getQueue rva rvb;
y <- setQueue rva rvb (queue @ [t]);
if null queue then addToBitmap rva rvb else return ()
od) \<sigma>). (\<sigma>', globals_update (\<lambda>x. t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) x))) x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) s))) \<in> rf_sr \<and> dc rv (xfdc (globals_update (\<lambda>x. t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) x))) x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat (UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) s)))))))}
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>rva rvb \<sigma>. (ksReadyQueues \<sigma> (rva, rvb) = [] \<longrightarrow> {s. Invariants_H.valid_queues \<sigma> \<and> (\<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b))) \<and> (\<exists>tcb. ko_at' tcb t \<sigma> \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = rvb \<and> valid_tcb' tcb \<sigma>) \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) rva = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rvb >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(rva := ksReadyQueuesL1Bitmap \<sigma> rva || 2 ^ prioToL1Index rvb), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((rva, invertL1Index (prioToL1Index rvb)) := ksReadyQueuesL2Bitmap \<sigma> (rva, invertL1Index (prioToL1Index rvb)) || 2 ^ unat (rvb && mask wordRadix))\<rparr>, s\<lparr>idx_' := UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb, queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) x)) (globals s\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals s)) (unat rva) (ksReadyQueuesL1Bitmap_' (globals s).[unat rva] || 2 ^ unat (rvb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals s)) (unat rva) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals s).[unat rva]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals s).[unat rva].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))] || 2 ^ unat (rvb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(rva := ksReadyQueuesL1Bitmap \<sigma> rva || 2 ^ prioToL1Index rvb), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((rva, invertL1Index (prioToL1Index rvb)) := ksReadyQueuesL2Bitmap \<sigma> (rva, invertL1Index (prioToL1Index rvb)) || 2 ^ unat (rvb && mask wordRadix))\<rparr>, globals_update (\<lambda>x. t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) x))) x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) s))) \<in> rf_sr))}) \<and> (ksReadyQueues \<sigma> (rva, rvb) \<noteq> [] \<longrightarrow> {s. Invariants_H.valid_queues \<sigma> \<and> (\<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b))) \<and> (\<exists>tcb. ko_at' tcb t \<sigma> \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = rvb \<and> valid_tcb' tcb \<sigma>) \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) rva = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rvb >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := ksReadyQueues \<sigma> (rva, rvb) @ [t])\<rparr>, s\<lparr>idx_' := UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb, queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) x)) (globals s\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals s)) (unat rva) (ksReadyQueuesL1Bitmap_' (globals s).[unat rva] || 2 ^ unat (rvb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals s)) (unat rva) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals s).[unat rva]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals s).[unat rva].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))] || 2 ^ unat (rvb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := ksReadyQueues \<sigma> (rva, rvb) @ [t])\<rparr>, globals_update (\<lambda>x. t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) x))) x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) s))) \<in> rf_sr))})
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>rva rvb \<sigma>. (ksReadyQueues \<sigma> (rva, rvb) = [] \<longrightarrow> {s. Invariants_H.valid_queues \<sigma> \<and> (\<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b))) \<and> (\<exists>tcb. ko_at' tcb t \<sigma> \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = rvb \<and> (\<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>) \<and> valid_tcb_state' (tcbState tcb) \<sigma> \<and> is_aligned (tcbIPCBuffer tcb) msg_align_bits \<and> valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma> \<and> tcbDomain tcb \<le> maxDomain \<and> tcbPriority tcb \<le> maxPriority \<and> tcbMCP tcb \<le> maxPriority) \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) rva = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rvb >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(rva := ksReadyQueuesL1Bitmap \<sigma> rva || 2 ^ prioToL1Index rvb), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((rva, invertL1Index (prioToL1Index rvb)) := ksReadyQueuesL2Bitmap \<sigma> (rva, invertL1Index (prioToL1Index rvb)) || 2 ^ unat (rvb && mask wordRadix))\<rparr>, s\<lparr>idx_' := UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb, queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) x)) (globals s\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals s)) (unat rva) (ksReadyQueuesL1Bitmap_' (globals s).[unat rva] || 2 ^ unat (rvb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals s)) (unat rva) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals s).[unat rva]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals s).[unat rva].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))] || 2 ^ unat (rvb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(rva := ksReadyQueuesL1Bitmap \<sigma> rva || 2 ^ prioToL1Index rvb), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((rva, invertL1Index (prioToL1Index rvb)) := ksReadyQueuesL2Bitmap \<sigma> (rva, invertL1Index (prioToL1Index rvb)) || 2 ^ unat (rvb && mask wordRadix))\<rparr>, globals_update (\<lambda>x. t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) x))) x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) s))) \<in> rf_sr))}) \<and> (ksReadyQueues \<sigma> (rva, rvb) \<noteq> [] \<longrightarrow> {s. Invariants_H.valid_queues \<sigma> \<and> (\<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b))) \<and> (\<exists>tcb. ko_at' tcb t \<sigma> \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = rvb \<and> (\<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>) \<and> valid_tcb_state' (tcbState tcb) \<sigma> \<and> is_aligned (tcbIPCBuffer tcb) msg_align_bits \<and> valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma> \<and> tcbDomain tcb \<le> maxDomain \<and> tcbPriority tcb \<le> maxPriority \<and> tcbMCP tcb \<le> maxPriority) \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) rva = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) rvb >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) rva < 0x10 \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := ksReadyQueues \<sigma> (rva, rvb) @ [t])\<rparr>, s\<lparr>idx_' := UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb, queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) x)) (globals s\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals s)) (unat rva) (ksReadyQueuesL1Bitmap_' (globals s).[unat rva] || 2 ^ unat (rvb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals s)) (unat rva) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals s).[unat rva]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals s).[unat rva].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) rvb >> wordRadix))] || 2 ^ unat (rvb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]) \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb < 0x1000 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((rva, rvb) := ksReadyQueues \<sigma> (rva, rvb) @ [t])\<rparr>, globals_update (\<lambda>x. t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) x))) x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals s)) (unat rva * 256 + unat rvb) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals s).[unat rva * 256 + unat rvb])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) rva * 0x100 + UCAST(8 \<rightarrow> 32) rvb) s))) \<in> rf_sr))})
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; \<exists>ko ko'. ko_at' ko t \<sigma> \<and> ko = tcb \<and> cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbDomain tcb \<le> UCAST(32 signed \<rightarrow> 8) maxDom
 2. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbPriority tcb \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio
 3. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbPriority tcb \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio
 2. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> \<forall>t\<in>set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)). tcb_at' t \<sigma>
 2. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL)\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL)\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL \<longrightarrow> ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []) \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> NULL
 2. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr)
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)\<rbrakk> \<Longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr)
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8
 2. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F))), ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> cbitmap_L1_relation (Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix))) ((ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)))
 2. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> cbitmap_L2_relation (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))) ((ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix)))
 3. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>)\<rparr>) \<in> rf_sr
 4. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 5. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 6. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 8. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> cbitmap_L2_relation (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (invertL1Index (prioToL1Index (tcbPriority tcb))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[invertL1Index (prioToL1Index (tcbPriority tcb))] || 2 ^ unat (tcbPriority tcb && 0x1F)))) ((ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix)))
 2. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>)\<rparr>) \<in> rf_sr
 3. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_) = []; Invariants_H.valid_queues \<sigma>_; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma>_ (a, b)); (\<sigma>_, x_) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb_)) \<sigma>_; valid_tcb_state' (tcbState tcb_) \<sigma>_; is_aligned (tcbIPCBuffer tcb_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb_) \<sigma>_; tcbDomain tcb_ \<le> maxDomain; tcbPriority tcb_ \<le> maxPriority; tcbMCP tcb_ \<le> maxPriority; ko_at' tcb_ t \<sigma>_; cslift x_ (tcb_ptr_to_ctcb_ptr t) = Some ko'_; ctcb_relation tcb_ ko'_; StateRelation_C.end_C (ksReadyQueues_' (globals x_).[cready_queues_index_to_C (tcbDomain tcb_) (tcbPriority tcb_)]) = NULL; head_C (ksReadyQueues_' (globals x_).[cready_queues_index_to_C (tcbDomain tcb_) (tcbPriority tcb_)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x_ NULL))) ((cslift x_)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'_)))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta_ = UCAST(8 \<rightarrow> 32) (tcbDomain tcb_) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb_); head_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) = NULL; ret__unsigned_long_' taa_ = UCAST(8 \<rightarrow> 32) (tcbPriority tcb_) >> wordRadix; ret__unsigned_long_' tb_ = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb_) >> wordRadix)\<rbrakk> \<Longrightarrow> cbitmap_L2_relation (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x_)) (unat (tcbDomain tcb_)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x_).[unat (tcbDomain tcb_)]) (invertL1Index (prioToL1Index (tcbPriority tcb_))) (ksReadyQueuesL2Bitmap_' (globals x_).[unat (tcbDomain tcb_)].[invertL1Index (prioToL1Index (tcbPriority tcb_))] || 2 ^ unat (tcbPriority tcb_ && 0x1F)))) ((ksReadyQueuesL2Bitmap \<sigma>_)((tcbDomain tcb_, invertL1Index (prioToL1Index (tcbPriority tcb_))) := ksReadyQueuesL2Bitmap \<sigma>_ (tcbDomain tcb_, invertL1Index (prioToL1Index (tcbPriority tcb_))) || 2 ^ unat (tcbPriority tcb_ && mask wordRadix))) proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 2. \<And>\<sigma> x tcb ko' ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>
 3. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ko' ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL; sched_queue_relation' (upd_unless_null NULL (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x NULL))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. NULL) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) [t] (tcb_ptr_to_ctcb_ptr t) (tcb_ptr_to_ctcb_ptr t); ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := [t]), ksReadyQueuesL1Bitmap := (ksReadyQueuesL1Bitmap \<sigma>)(tcbDomain tcb := ksReadyQueuesL1Bitmap \<sigma> (tcbDomain tcb) || 2 ^ prioToL1Index (tcbPriority tcb)), ksReadyQueuesL2Bitmap := (ksReadyQueuesL2Bitmap \<sigma>)((tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) := ksReadyQueuesL2Bitmap \<sigma> (tcbDomain tcb, invertL1Index (prioToL1Index (tcbPriority tcb))) || 2 ^ unat (tcbPriority tcb && mask wordRadix))\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (numDomains \<le> Suc 0 \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = 0) \<and> ((\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr))
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) < 0x10 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr)
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)\<rbrakk> \<Longrightarrow> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)) \<longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr) \<and> (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr)
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); \<exists>ko ko'. ko_at' ko t \<sigma> \<and> ko = tcb \<and> cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbDomain tcb \<le> UCAST(32 signed \<rightarrow> 8) maxDom
 2. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbPriority tcb \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio
 3. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 4. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbPriority tcb \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio
 2. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> \<forall>t\<in>set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)). tcb_at' t \<sigma>
 2. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL \<longrightarrow> ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []) \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<notin> tcb_ptr_to_ctcb_ptr ` set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))
 2. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> NULL
 3. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 4. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> NULL
 2. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta taa tb ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) = NULL; ret__unsigned_long_' taa = UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix; ret__unsigned_long_' tb = word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix); ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))\<rbrakk> \<Longrightarrow> word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix) < 8 \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, x\<lparr>idx_' := UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb), queue_' := tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) xa)) (globals x\<lparr>ksReadyQueuesL1Bitmap_' := Arrays.update (ksReadyQueuesL1Bitmap_' (globals x)) (unat (tcbDomain tcb)) (ksReadyQueuesL1Bitmap_' (globals x).[unat (tcbDomain tcb)] || 2 ^ unat (tcbPriority tcb >> wordRadix)), ksReadyQueuesL2Bitmap_' := Arrays.update (ksReadyQueuesL2Bitmap_' (globals x)) (unat (tcbDomain tcb)) (Arrays.update (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)]) (unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))) (ksReadyQueuesL2Bitmap_' (globals x).[unat (tcbDomain tcb)].[unat (word_of_nat l2BitmapSize - 1 - (UCAST(8 \<rightarrow> 32) (tcbPriority tcb) >> wordRadix))] || 2 ^ unat (tcbPriority tcb && 0x1F)))\<rparr>)\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (head_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; ko_at' tcb t \<sigma>; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; \<exists>ko ko'. ko_at' ko t \<sigma> \<and> ko = tcb \<and> cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbDomain tcb \<le> UCAST(32 signed \<rightarrow> 8) maxDom
 2. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbPriority tcb \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio
 3. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'\<rbrakk> \<Longrightarrow> tcbPriority tcb \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio
 2. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))\<rbrakk> \<Longrightarrow> \<forall>t\<in>set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)). tcb_at' t \<sigma>
 2. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; sched_queue_relation' (cslift x) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL) = (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL); (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) = NULL \<longrightarrow> ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) = []) \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<notin> tcb_ptr_to_ctcb_ptr ` set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))
 2. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> NULL
 3. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)))\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> NULL
 2. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL; head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<and> (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]) \<noteq> NULL \<longrightarrow> ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb))); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[cready_queues_index_to_C (tcbDomain tcb) (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko'. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (the (cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))))) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); \<exists>ko ko'. ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma> \<and> inQ (tcbDomain tcb) (tcbPriority tcb) ko \<and> cslift x (tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t \<and> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); (\<sigma>, x) \<in> rf_sr; \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' (upd_unless_null (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksReadyQueues := (ksReadyQueues \<sigma>)((tcbDomain tcb, tcbPriority tcb) := ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t])\<rparr>, globals_update (\<lambda>xa. t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedNext_C''])) NULL) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbSchedPrev_C''])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) (hrs_mem_update (heap_update (PTR(tcb_C ptr) &(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rightarrow>[''tcbSchedNext_C''])) (tcb_ptr_to_ctcb_ptr t)) xa))) xa\<lparr>ksReadyQueues_' := Arrays.update (ksReadyQueues_' (globals x)) (unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)) (tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))\<rparr>) (queue_'_update (\<lambda>_. tcb_queue_C.end_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (idx_'_update (\<lambda>_. UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) x))) \<in> rf_sr
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a, tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 4. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>) \<and> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p'))))
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'a))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<and> (tcb_ptr_to_ctcb_ptr t \<noteq> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a, tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t))
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 4. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>) \<and> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p'))))
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'a))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a, tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 4. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 5. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>) \<and> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p'))))
 6. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 8. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko')) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'; ctcb_relation ko ko'; tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])\<rbrakk> \<Longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a, tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 4. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 5. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>) \<and> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p'))))
 6. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 8. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr t \<noteq> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<longrightarrow> sched_queue_relation' ((cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a, tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'))) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t)
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 4. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>) \<and> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p'))))
 5. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 7. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 10. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>) \<and> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p'))))
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) t \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) t \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) t \<sigma> \<or> tcb_at' t \<sigma>) \<and> (obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p'))))
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> obj_at' (inQ (tcbDomain tcb) (tcbPriority tcb)) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> obj_at' (\<lambda>tcba. tcbDomain tcba = tcbDomain tcb) (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<or> tcb_at' (?v2006 \<sigma> x tcb ta ko' ko ko'a) \<sigma> \<and> (\<forall>d' p'. (d' = tcbDomain tcb \<longrightarrow> p' \<noteq> tcbPriority tcb) \<longrightarrow> ?v2006 \<sigma> x tcb ta ko' ko ko'a \<notin> set (ksReadyQueues \<sigma> (d', p')))
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (?v2006 \<sigma> x tcb ta ko' ko ko'a)})\<^esub>
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))})\<^esub>
 3. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 4. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 6. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 9. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_) \<noteq> []; Invariants_H.valid_queues \<sigma>_; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma>_ (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb_)) \<sigma>_; valid_tcb_state' (tcbState tcb_) \<sigma>_; is_aligned (tcbIPCBuffer tcb_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb_) \<sigma>_; tcbDomain tcb_ \<le> maxDomain; tcbPriority tcb_ \<le> maxPriority; tcbMCP tcb_ \<le> maxPriority; ret__unsigned_long_' ta_ = UCAST(8 \<rightarrow> 32) (tcbDomain tcb_) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb_); head_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> NULL; ko_at' tcb_ t \<sigma>_; cslift x_ (tcb_ptr_to_ctcb_ptr t) = Some ko'_; ctcb_relation tcb_ ko'_; StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> NULL; sched_queue_relation' ((cslift x_)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'_), StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a_)) (ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_) @ [t]) (head_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko_ (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]))) \<sigma>_; inQ (tcbDomain tcb_) (tcbPriority tcb_) ko_; cslift x_ (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) = Some ko'a_; ctcb_relation ko_ ko'a_\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>_ proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) then (cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))} - {StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a) else cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))})\<^esub>) = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])))})\<^esub>
 2. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 3. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 5. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 8. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 10. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_) \<noteq> []; Invariants_H.valid_queues \<sigma>_; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma>_ (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb_)) \<sigma>_; valid_tcb_state' (tcbState tcb_) \<sigma>_; is_aligned (tcbIPCBuffer tcb_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb_) \<sigma>_; tcbDomain tcb_ \<le> maxDomain; tcbPriority tcb_ \<le> maxPriority; tcbMCP tcb_ \<le> maxPriority; ret__unsigned_long_' ta_ = UCAST(8 \<rightarrow> 32) (tcbDomain tcb_) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb_); head_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> NULL; ko_at' tcb_ t \<sigma>_; cslift x_ (tcb_ptr_to_ctcb_ptr t) = Some ko'_; ctcb_relation tcb_ ko'_; StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) \<in> set (ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_)); sched_queue_relation' ((cslift x_)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'_), StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a_)) (ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_) @ [t]) (head_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko_ (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]))) \<sigma>_; inQ (tcbDomain tcb_) (tcbPriority tcb_) ko_; cslift x_ (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) = Some ko'a_; ctcb_relation ko_ ko'a_\<rbrakk> \<Longrightarrow> (if StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> tcb_ptr_to_ctcb_ptr t \<and> StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]))) then (cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])))} - {StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])})\<^esub>)(StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a_) else cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])))})\<^esub>) = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr t, tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])))})\<^esub> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x tcb ta ko' ko ko'a. \<lbrakk>ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) \<noteq> []; Invariants_H.valid_queues \<sigma>; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma> (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb)) \<sigma>; valid_tcb_state' (tcbState tcb) \<sigma>; is_aligned (tcbIPCBuffer tcb) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb) \<sigma>; tcbDomain tcb \<le> maxDomain; tcbPriority tcb \<le> maxPriority; tcbMCP tcb \<le> maxPriority; ret__unsigned_long_' ta = UCAST(8 \<rightarrow> 32) (tcbDomain tcb) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb); head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ko_at' tcb t \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr t) = Some ko'; ctcb_relation tcb ko'; StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) \<in> set (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb)); sched_queue_relation' ((cslift x)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'), StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a)) (ksReadyQueues \<sigma> (tcbDomain tcb, tcbPriority tcb) @ [t]) (head_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]))) \<sigma>; inQ (tcbDomain tcb) (tcbPriority tcb) ko; cslift x (StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) = Some ko'a; ctcb_relation ko ko'a\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x)(StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x).[unat (tcbDomain tcb) * 256 + unat (tcbPriority tcb)])) ko'a else ko')))) = map_option tcb_null_sched_ptrs \<circ> cslift x
 2. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 4. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 7. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 9. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 10. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_) \<noteq> []; Invariants_H.valid_queues \<sigma>_; \<forall>a b. t \<notin> set (ksReadyQueues \<sigma>_ (a, b)); \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> valid_cap' (cteCap (getF tcb_)) \<sigma>_; valid_tcb_state' (tcbState tcb_) \<sigma>_; is_aligned (tcbIPCBuffer tcb_) msg_align_bits; valid_bound_ntfn' (tcbBoundNotification tcb_) \<sigma>_; tcbDomain tcb_ \<le> maxDomain; tcbPriority tcb_ \<le> maxPriority; tcbMCP tcb_ \<le> maxPriority; ret__unsigned_long_' ta_ = UCAST(8 \<rightarrow> 32) (tcbDomain tcb_) * 0x100 + UCAST(8 \<rightarrow> 32) (tcbPriority tcb_); head_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> NULL; ko_at' tcb_ t \<sigma>_; cslift x_ (tcb_ptr_to_ctcb_ptr t) = Some ko'_; ctcb_relation tcb_ ko'_; StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<noteq> NULL; ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) \<in> set (ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_)); sched_queue_relation' ((cslift x_)(tcb_ptr_to_ctcb_ptr t \<mapsto> tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) (tcbSchedNext_C_update (\<lambda>_. NULL) ko'_), StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<mapsto> tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a_)) (ksReadyQueues \<sigma>_ (tcbDomain tcb_, tcbPriority tcb_) @ [t]) (head_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) (tcb_ptr_to_ctcb_ptr t); ko_at' ko_ (ctcb_ptr_to_tcb_ptr (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]))) \<sigma>_; inQ (tcbDomain tcb_) (tcbPriority tcb_) ko_; cslift x_ (StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) = Some ko'a_; ctcb_relation ko_ ko'a_\<rbrakk> \<Longrightarrow> (map_option tcb_null_sched_ptrs \<circ> cslift x_)(StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) \<mapsto> tcb_null_sched_ptrs (tcbSchedNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr t) ko'a_), tcb_ptr_to_ctcb_ptr t \<mapsto> tcb_null_sched_ptrs (tcbSchedPrev_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) (tcbSchedNext_C_update (\<lambda>_. NULL) (if tcb_ptr_to_ctcb_ptr t = StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)]) then tcbSchedNext_C_update (\<lambda>_. StateRelation_C.end_C (ksReadyQueues_' (globals x_).[unat (tcbDomain tcb_) * 256 + unat (tcbPriority tcb_)])) ko'a_ else ko'_)))) = map_option tcb_null_sched_ptrs \<circ> cslift x_ proof (prove)
goal (9 subgoals):
 1. \<And>tcb rv rv' rva rv'a rvb rv'b. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva; rv'b = UCAST(8 \<rightarrow> 32) rvb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'c. {s. v32_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])) s) \<in> \<lbrace>\<acute>v32 = from_bool True \<and> \<acute>thread_state_ptr = PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbState_C''])\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 3. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 6. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 8. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 9. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (8 subgoals):
 1. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 tcb rv rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a. (\<lambda>b. Invariants_H.valid_queues b \<and> (\<forall>p. t \<notin> set (ksReadyQueues b p)) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b)) and tcb_at' t\<rbrace>
 2. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 6. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 8. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (8 subgoals):
 1. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1251 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv' rva\<rbrace> threadGet tcbPriority t \<lbrace>\<lambda>a b. Invariants_H.valid_queues b \<and> (\<forall>a ba. t \<notin> set (ksReadyQueues b (a, ba))) \<and> (\<exists>tcb. ko_at' tcb t b \<and> tcbDomain tcb = rva \<and> tcbPriority tcb = a \<and> valid_tcb' tcb b) \<and> tcb_at' t b\<rbrace>
 2. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?R1251 tcb rv rv' rva\<rbrace>
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 5. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 6. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 7. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 8. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (7 subgoals):
 1. \<And>tcb rv rv' rva rv'a. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'; rv'a = UCAST(8 \<rightarrow> 32) rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1248 tcb rv rv' rva rv'a\<^esub> (?R'1248 tcb rv rv' rva rv'a) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>prio :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. prio_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV}
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcba. ko_at' tcba t a \<and> tcbDomain tcba = rva \<and> tcbPriority tcba = tcbPriority tcb \<and> valid_tcb' tcba a) \<and> tcb_at' t a)\<rbrace>
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rva. dom_' s = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> UNIV \<inter> ?R'1248 tcb rv rv' rva (dom_' s)}
 4. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 6. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 7. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcba. ko_at' tcba t a \<and> tcbDomain tcba = rva \<and> tcbPriority tcba = tcbPriority tcb \<and> valid_tcb' tcba a) \<and> tcb_at' t a)\<rbrace>
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rv. dom_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (6 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R961 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')\<rbrace> threadGet tcbDomain t \<lbrace>\<lambda>rva a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcba. ko_at' tcba t a \<and> tcbDomain tcba = rva \<and> tcbPriority tcba = tcbPriority tcb \<and> valid_tcb' tcba a) \<and> tcb_at' t a\<rbrace>
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rv. dom_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and ?R961 tcb a) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 5. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 6. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (5 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F953 tcb rv rv'\<^esub> (?R'955 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>dom :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbDomain_C'']))) {s. \<forall>rv. dom_' s = UCAST(8 \<rightarrow> 32) rv \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 2. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> (\<forall>tcba. ko_at' tcba t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcbb. ko_at' tcbb t a \<and> tcbDomain tcbb = tcbDomain tcb \<and> tcbPriority tcbb = tcbPriority tcba \<and> valid_tcb' tcbb a) \<and> tcb_at' t a))) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 4. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {sa. \<forall>v. queue_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dom_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. prio_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. idx_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> ?R'955 tcb rv (ret__unsigned_' s)}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 5. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (4 subgoals):
 1. \<And>tcb rv rv'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; rv = to_bool rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf818 (tcb_ptr_to_ctcb_ptr t) (to_bool rv')) (?Rf812 (tcb_ptr_to_ctcb_ptr t) (to_bool rv') rv') [SKIP] (return ()) SKIP
 2. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> (\<forall>tcba. ko_at' tcba t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcbb. ko_at' tcbb t a \<and> tcbDomain tcbb = tcbDomain tcb \<and> tcbPriority tcbb = tcbPriority tcba \<and> valid_tcb' tcbb a) \<and> tcb_at' t a))) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> ?Pf818 tcb a s)\<rbrace>
 3. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dom_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prio_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. idx_'_update (\<lambda>_. v) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> ?Rf812 tcb rv (ret__unsigned_' s) \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 4. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (3 subgoals):
 1. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<lbrace>?R421 tcb\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. \<not> a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> (\<forall>tcba. ko_at' tcba t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcbb. ko_at' tcbb t a \<and> tcbDomain tcbb = tcbDomain tcb \<and> tcbPriority tcbb = tcbPriority tcba \<and> valid_tcb' tcbb a) \<and> tcb_at' t a))) s) and (\<lambda>s. \<not> \<not> a \<longrightarrow> True)\<rbrace>
 2. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dom_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prio_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. idx_'_update (\<lambda>_. v) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 3. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (3 subgoals):
 1. \<lbrace>?R421 (tcb_ptr_to_ctcb_ptr t)\<rbrace> threadGet tcbQueued t \<lbrace>\<lambda>a b. \<not> a \<longrightarrow> (\<forall>tcb. ko_at' tcb t b \<longrightarrow> (\<forall>tcba. ko_at' tcba t b \<longrightarrow> Invariants_H.valid_queues b \<and> (\<forall>a ba. t \<notin> set (ksReadyQueues b (a, ba))) \<and> (\<exists>tcbb. ko_at' tcbb t b \<and> tcbDomain tcbb = tcbDomain tcb \<and> tcbPriority tcbb = tcbPriority tcba \<and> valid_tcb' tcbb b) \<and> tcb_at' t b))\<rbrace>
 2. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dom_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prio_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. idx_'_update (\<lambda>_. v) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 3. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R421 tcb) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (2 subgoals):
 1. \<And>tcb. tcb = tcb_ptr_to_ctcb_ptr t \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F421 tcb\<^esub> (?R'421 tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb} (\<acute>ret__unsigned :== CALL thread_state_get_tcbQueued_'proc(h_val (hrs_mem \<acute>t_hrs) (PTR(thread_state_C) &(tcb\<rightarrow>[''tcbState_C''])))) {s. \<forall>rv. rv = to_bool (ret__unsigned_' s) \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dom_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prio_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. idx_'_update (\<lambda>_. v) s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__unsigned = 0\<rbrace>}
 2. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> \<not> tcbQueued tcb \<longrightarrow> (\<forall>tcb. ko_at' tcb t a \<longrightarrow> (\<forall>tcba. ko_at' tcba t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcbb. ko_at' tcbb t a \<and> tcbDomain tcbb = tcbDomain tcb \<and> tcbPriority tcbb = tcbPriority tcba \<and> valid_tcb' tcbb a) \<and> tcb_at' t a)))) s \<and> s' \<in> UNIV \<inter> ?R'421 tcb proof (prove)
goal (1 subgoal):
 1. \<And>tcb s s'. \<lbrakk>tcb = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; (Invariants_H.valid_queues and tcb_at' t and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. \<forall>tcb. ko_at' tcb t a \<longrightarrow> \<not> tcbQueued tcb \<longrightarrow> (\<forall>tcb. ko_at' tcb t a \<longrightarrow> (\<forall>tcba. ko_at' tcba t a \<longrightarrow> Invariants_H.valid_queues a \<and> (\<forall>aa b. t \<notin> set (ksReadyQueues a (aa, b))) \<and> (\<exists>tcbb. ko_at' tcbb t a \<and> tcbDomain tcbb = tcbDomain tcb \<and> tcbPriority tcbb = tcbPriority tcba \<and> valid_tcb' tcbb a) \<and> tcb_at' t a)))) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (state)
this:
ccorres dc xfdc (Invariants_H.valid_queues and tcb_at' t and valid_objs') (UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr t\<rbrace>) [] (tcbSchedAppend t) (Call tcbSchedAppend_'proc)

goal:
No subgoals!