theory Refine_C

lemma kernel_all_subset_kernel:
  "global_automaton (kernel_global.check_active_irq_C symbol_table) (do_user_op_C uop)
       (kernel_global.kernel_call_C symbol_table fp)
       \<subseteq> global_automaton check_active_irq_C (do_user_op_C uop) (kernel_call_C fp)" apply (clarsimp simp: fw_sim_def rel_semi_def global_automaton_def
                        relcomp_unfold in_lift_state_relation_eq) apply (intro conjI) apply (simp_all add: kernel_global.kernel_call_C_def
                    kernel_call_C_def kernelEntry_C_def
                    setTCBContext_C_def
                    kernel_global.kernelEntry_C_def
                     exec_C_Basic
                    kernel_global.setTCBContext_C_def
                    kernel_call_H_def kernelEntry_def
                    getContext_C_def
                    check_active_irq_C_def checkActiveIRQ_C_def
                    kernel_global.check_active_irq_C_def kernel_global.checkActiveIRQ_C_def
                    check_active_irq_H_def checkActiveIRQ_def) apply clarsimp apply (erule in_monad_imp_rewriteE[where F=True]) apply (rule monadic_rewrite_guard_imp) apply (rule monadic_rewrite_bind_tail)+ apply (rule monadic_rewrite_bind_head[where P=\<top>]) apply (simp add: callKernel_C_def callKernel_withFastpath_C_def
                            kernel_global.callKernel_C_def
                            kernel_global.callKernel_withFastpath_C_def
                            handleHypervisorEvent_C_def kernel_global.handleHypervisorEvent_C_def
                       split: event.split if_split) apply (intro allI impI conjI monadic_rewrite_\<Gamma>)[1] apply ((wp | simp)+)[3] apply (clarsimp simp: snd_bind snd_modify in_monad gets_def) apply clarsimp apply clarsimp apply clarsimp apply (clarsimp simp: in_monad) apply (erule (1) notE[OF _ in_monad_imp_rewriteE[where F=True]]) apply (simp add: kernel_global.getActiveIRQ_C_def getActiveIRQ_C_def) apply (rule monadic_rewrite_\<Gamma>) apply (simp add: no_fail_getActiveIRQ_C) apply (clarsimp simp: in_monad) apply (erule (1) notE[OF _ in_monad_imp_rewriteE[where F=True]]) apply (simp add: kernel_global.getActiveIRQ_C_def getActiveIRQ_C_def) apply (rule monadic_rewrite_\<Gamma>) apply (simp add: no_fail_getActiveIRQ_C) apply (clarsimp simp: in_monad) apply (erule (1) notE[OF _ in_monad_imp_rewriteE[where F=True]]) apply (simp add: kernel_global.getActiveIRQ_C_def getActiveIRQ_C_def) apply (rule monadic_rewrite_\<Gamma>) apply (simp add: no_fail_getActiveIRQ_C) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. global_automaton (kernel_global.check_active_irq_C symbol_table) (do_user_op_C uop) (kernel_global.kernel_call_C symbol_table fp) \<subseteq> global_automaton check_active_irq_C (do_user_op_C uop) (kernel_call_C fp) proof (prove)
goal (1 subgoal):
 1. {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_global.kernel_call_C symbol_table fp e} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<and> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<and> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<and> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> kernel_global.check_active_irq_C symbol_table} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<and> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> kernel_global.check_active_irq_C symbol_table} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<and> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> kernel_global.check_active_irq_C symbol_table} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} proof (prove)
goal (6 subgoals):
 1. {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_global.kernel_call_C symbol_table fp e} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C}
 2. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C}
 3. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C}
 4. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> kernel_global.check_active_irq_C symbol_table} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C}
 5. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> kernel_global.check_active_irq_C symbol_table} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C}
 6. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> kernel_global.check_active_irq_C symbol_table} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. ((a, b), m, aa, ba) \<in> kernel_call_C fp e} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. ((a, b), False, aa, ba) \<in> check_active_irq_C} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. ((a, b), True, aa, ba) \<in> check_active_irq_C} proof (prove)
goal (6 subgoals):
 1. {(((a, b), KernelMode, Some e), (aa, ba), if ct_running_C ba then UserMode else IdleMode, None) |a b aa ba e. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then kernel_global.callKernel_withFastpath_C symbol_table e else kernel_global.callKernel_C symbol_table e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 2. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 5. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 6. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (6 subgoals):
 1. \<And>ad bd ae be e. \<lbrakk>(ae, be) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then kernel_global.callKernel_withFastpath_C symbol_table e else kernel_global.callKernel_C symbol_table e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd); \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)\<rbrakk> \<Longrightarrow> (ae, be) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 2. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 5. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 6. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (7 subgoals):
 1. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) (do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) (do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then kernel_global.callKernel_withFastpath_C symbol_table e else kernel_global.callKernel_C symbol_table e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od)
 2. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> True \<longrightarrow> \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 3. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 5. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 6. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 7. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (8 subgoals):
 1. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> monadic_rewrite True False (?Q62 ad bd ae be e) (do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) (do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then kernel_global.callKernel_withFastpath_C symbol_table e else kernel_global.callKernel_C symbol_table e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od)
 2. \<And>ad bd ae be e s. \<lbrakk>\<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd); True\<rbrakk> \<Longrightarrow> ?Q62 ad bd ae be e s
 3. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> True \<longrightarrow> \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 4. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 5. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 6. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 7. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 8. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (10 subgoals):
 1. \<And>ad bd ae be e x xa. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> monadic_rewrite True False (?Q68 ad bd ae be e x xa) (do y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) (do y <- if fp then kernel_global.callKernel_withFastpath_C symbol_table e else kernel_global.callKernel_C symbol_table e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od)
 2. \<And>ad bd ae be e x. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q65 ad bd ae be e x\<rbrace> modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(x\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s) \<lbrace>?Q68 ad bd ae be e x\<rbrace>
 3. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q62 ad bd ae be e\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>?Q65 ad bd ae be e\<rbrace>
 4. \<And>ad bd ae be e s. \<lbrakk>\<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd); True\<rbrakk> \<Longrightarrow> ?Q62 ad bd ae be e s
 5. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> True \<longrightarrow> \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 6. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 7. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 8. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 9. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 10. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (10 subgoals):
 1. \<And>ad bd ae be e x xa. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) (if fp then callKernel_withFastpath_C e else callKernel_C e) (if fp then kernel_global.callKernel_withFastpath_C symbol_table e else kernel_global.callKernel_C symbol_table e)
 2. \<And>ad bd ae be e x. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q65 ad bd ae be e x\<rbrace> modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(x\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s) \<lbrace>\<lambda>xa _. True\<rbrace>
 3. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q62 ad bd ae be e\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>?Q65 ad bd ae be e\<rbrace>
 4. \<And>ad bd ae be e s. \<lbrakk>\<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd); True\<rbrakk> \<Longrightarrow> ?Q62 ad bd ae be e s
 5. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> True \<longrightarrow> \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 6. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 7. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 8. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 9. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 10. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (10 subgoals):
 1. \<And>ad bd e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> (\<forall>x1. (x1 = syscall.SysCall \<longrightarrow> e = SyscallEvent syscall.SysCall \<longrightarrow> (fp \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>cptr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
\<acute>msgInfo :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
Cond UNIV (CALL fastpath_call_'proc()) (CALL fastpath_reply_recv_'proc()))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>cptr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
\<acute>msgInfo :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
Cond UNIV (CALL fastpath_call_'proc()) (CALL fastpath_reply_recv_'proc())))) \<and> (\<not> fp \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>ret__unsigned_long :== CALL handleSyscall_'proc(syscall_from_H syscall.SysCall))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>ret__unsigned_long :== CALL handleSyscall_'proc(syscall_from_H syscall.SysCall))))) \<and> (x1 = syscall.SysReplyRecv \<longrightarrow> e = SyscallEvent syscall.SysReplyRecv \<longrightarrow> (fp \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>cptr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
\<acute>msgInfo :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
Cond {} (CALL fastpath_call_'proc()) (CALL fastpath_reply_recv_'proc()))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>cptr :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.capRegister);;
\<acute>msgInfo :== CALL getRegister_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
Cond {} (CALL fastpath_call_'proc()) (CALL fastpath_reply_recv_'proc())))) \<and> (\<not> fp \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>ret__unsigned_long :== CALL handleSyscall_'proc(syscall_from_H syscall.SysReplyRecv))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>ret__unsigned_long :== CALL handleSyscall_'proc(syscall_from_H syscall.SysReplyRecv))))) \<and> (x1 \<noteq> syscall.SysCall \<and> x1 \<noteq> syscall.SysReplyRecv \<longrightarrow> e = SyscallEvent x1 \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>ret__unsigned_long :== CALL handleSyscall_'proc(syscall_from_H x1))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>ret__unsigned_long :== CALL handleSyscall_'proc(syscall_from_H x1))))) \<and> (\<forall>x2. e = UnknownSyscall x2 \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>ret__unsigned_long :== CALL handleUnknownSyscall_'proc(word_of_nat x2))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>ret__unsigned_long :== CALL handleUnknownSyscall_'proc(word_of_nat x2)))) \<and> (\<forall>x31 x32. e = UserLevelFault x31 x32 \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>ret__unsigned_long :== CALL handleUserLevelFault_'proc(x31,x32))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>ret__unsigned_long :== CALL handleUserLevelFault_'proc(x31,x32)))) \<and> (e = Interrupt \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (Call handleInterruptEntry_'proc)) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (Call handleInterruptEntry_'proc))) \<and> (\<forall>x5. e = VMFaultEvent x5 \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (\<acute>ret__unsigned_long :== CALL handleVMFaultEvent_'proc(vm_fault_type_from_H x5))) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (\<acute>ret__unsigned_long :== CALL handleVMFaultEvent_'proc(vm_fault_type_from_H x5)))) \<and> ((\<exists>x6. e = HypervisorEvent x6) \<longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (CALL schedule_'proc();;
CALL activateThread_'proc())) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (CALL schedule_'proc();;
CALL activateThread_'proc())))
 2. \<And>ad bd ae be e x. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q65 ad bd ae be e x\<rbrace> modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(x\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s) \<lbrace>\<lambda>xa _. True\<rbrace>
 3. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q62 ad bd ae be e\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>?Q65 ad bd ae be e\<rbrace>
 4. \<And>ad bd ae be e s. \<lbrakk>\<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd); True\<rbrakk> \<Longrightarrow> ?Q62 ad bd ae be e s
 5. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> True \<longrightarrow> \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 6. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 7. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 8. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 9. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 10. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (9 subgoals):
 1. \<And>ad bd ae be e x. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q65 ad bd ae be e x\<rbrace> modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(x\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s) \<lbrace>\<lambda>xa _. True\<rbrace>
 2. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> \<lbrace>?Q62 ad bd ae be e\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>?Q65 ad bd ae be e\<rbrace>
 3. \<And>ad bd ae be e s. \<lbrakk>\<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd); True\<rbrakk> \<Longrightarrow> ?Q62 ad bd ae be e s
 4. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> True \<longrightarrow> \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 5. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 6. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 7. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 8. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 9. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (6 subgoals):
 1. \<And>ad bd ae be e. \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd) \<Longrightarrow> True \<longrightarrow> \<not> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C ad)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) bd)
 2. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 5. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 6. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (5 subgoals):
 1. {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 2. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 5. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (4 subgoals):
 1. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 2. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (3 subgoals):
 1. {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 2. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (3 subgoals):
 1. \<And>ad bd ae be. \<lbrakk>(True, be) \<notin> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) bd); ((ad, bd), Some Interrupt, ae, be) \<notin> do_user_op_C uop; (True, be) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) bd)\<rbrakk> \<Longrightarrow> False
 2. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (3 subgoals):
 1. \<And>ad bd ae be. \<lbrakk>((), be) \<notin> fst (getActiveIRQ_C bd); ((ad, bd), Some Interrupt, ae, be) \<notin> do_user_op_C uop; ((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> False
 2. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (4 subgoals):
 1. \<And>ad bd ae be. \<lbrakk>((ad, bd), Some Interrupt, ae, be) \<notin> do_user_op_C uop; ((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) getActiveIRQ_C (kernel_global.getActiveIRQ_C symbol_table)
 2. \<And>ad bd ae be. \<lbrakk>((ad, bd), Some Interrupt, ae, be) \<notin> do_user_op_C uop; ((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd)
 3. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (4 subgoals):
 1. \<And>ad bd ae be. \<lbrakk>((ad, bd), Some Interrupt, ae, be) \<notin> do_user_op_C uop; ((), be) \<in> fst (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (Call getActiveIRQ_'proc) bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (Call getActiveIRQ_'proc)) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (Call getActiveIRQ_'proc))
 2. \<And>ad bd ae be. \<lbrakk>((ad, bd), Some Interrupt, ae, be) \<notin> do_user_op_C uop; ((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd)
 3. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 4. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (3 subgoals):
 1. \<And>ad bd ae be. \<lbrakk>((ad, bd), Some Interrupt, ae, be) \<notin> do_user_op_C uop; ((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd)
 2. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 3. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (2 subgoals):
 1. {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)}
 2. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (2 subgoals):
 1. \<And>bd be. \<lbrakk>((), be) \<notin> fst (getActiveIRQ_C bd); ((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be = kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> False
 2. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (3 subgoals):
 1. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be = kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) getActiveIRQ_C (kernel_global.getActiveIRQ_C symbol_table)
 2. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be = kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd)
 3. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (3 subgoals):
 1. \<And>bd be. \<lbrakk>((), be) \<in> fst (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (Call getActiveIRQ_'proc) bd); ret__unsigned_long_' be = kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (Call getActiveIRQ_'proc)) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (Call getActiveIRQ_'proc))
 2. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be = kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd)
 3. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (2 subgoals):
 1. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be = kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd)
 2. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (1 subgoal):
 1. {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- kernel_global.getActiveIRQ_C symbol_table;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<subseteq> {(((a, b), KernelMode, Some e), (aa, ba), m, None) |a b aa ba e m. (aa, ba) \<in> fst ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b) \<and> m = (if ct_running_C ba then UserMode else IdleMode) \<or> snd ((do t <- gets (ksCurThread_' \<circ> globals);
y <- modify (\<lambda>s. globals_update (t_hrs_'_update (\<lambda>_. hrs_mem_update (heap_update (PTR(user_context_C) &(PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])) (to_user_context_C a)) (t_hrs_' (globals s)))) s);
y <- if fp then callKernel_withFastpath_C e else callKernel_C e;
t <- gets (ksCurThread_' \<circ> globals);
gets (\<lambda>s. from_user_context_C (tcbContext_C (the (cslift s (PTR(arch_tcb_C) &(t\<rightarrow>[''tcbArch_C'']))))))
od) b)} \<union> {(((a, b), UserMode, None), (aa, ba), UserMode, None) |a b aa ba. ((a, b), None, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some e) |a b aa ba e. ((a, b), Some e, aa, ba) \<in> do_user_op_C uop} \<union> {(((a, b), UserMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), IdleMode, None) |a b aa ba. (False, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} \<union> {(((a, b), IdleMode, None), (aa, ba), KernelMode, Some Interrupt) |a b aa ba. (True, ba) \<in> fst ((do y <- getActiveIRQ_C;
irq <- gets ret__unsigned_long_';
return (irq \<noteq> kernel_all_global_addresses.irqInvalid)
od) b)} proof (prove)
goal (1 subgoal):
 1. \<And>bd be. \<lbrakk>((), be) \<notin> fst (getActiveIRQ_C bd); ((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) getActiveIRQ_C (kernel_global.getActiveIRQ_C symbol_table)
 2. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd) proof (prove)
goal (2 subgoals):
 1. \<And>bd be. \<lbrakk>((), be) \<in> fst (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (Call getActiveIRQ_'proc) bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> monadic_rewrite True False (\<lambda>_. True) (exec_C \<Gamma> (Call getActiveIRQ_'proc)) (exec_C (kernel_all_global_addresses.\<Gamma> symbol_table) (Call getActiveIRQ_'proc))
 2. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd) proof (prove)
goal (1 subgoal):
 1. \<And>bd be. \<lbrakk>((), be) \<in> fst (kernel_global.getActiveIRQ_C symbol_table bd); ret__unsigned_long_' be \<noteq> kernel_all_global_addresses.irqInvalid\<rbrakk> \<Longrightarrow> True \<longrightarrow> \<not> snd (getActiveIRQ_C bd) proof (prove)
goal:
No subgoals!