theory ADT_IF_Refine_C

lemma kernelEntry_corres_C:
  "corres_underlying rf_sr False False
     (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) \<top>
     (kernelEntry_if e tc) (kernelEntry_C_if fp e tc)" using corres_nofail[OF kernel_entry_if_corres[of e tc], simplified] supply nonzero_gt_zero[simp] gt_zero_nonzero[simp] apply (simp add: kernelEntry_if_def kernelEntry_C_if_def) apply (simp only: bind_assoc[symmetric]) apply (rule corres_stateAssert_no_fail) apply (erule no_fail_pre) apply (clarsimp simp: all_invs'_def) apply (rule exI, rule conjI, assumption) apply clarsimp apply (simp only: bind_assoc) apply (simp add: getCurThread_def) apply (rule corres_guard_imp) apply (rule corres_split[where P=\<top> and P'=\<top> and r'="\<lambda>t t'. t' = tcb_ptr_to_ctcb_ptr t"]) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (rule corres_split) apply (subst archTcbUpdate_aux2[symmetric]) apply (rule setTCBContext_C_corres) apply (simp add: ccontext_rel_to_C) apply simp apply (rule corres_split[OF ccorres_corres_u_xf, simplified bind_assoc]) prefer 2 apply (rule corres_nofail) apply (rule handleEvent_corres) apply simp apply (rule_tac Q'="UNIV" in ccorres_guard_imp) apply (rule handleEvent_ccorres) apply (clarsimp simp: all_invs'_def) apply simp apply (rule_tac P="\<top>" and P'="\<top>" in corres_inst) apply (clarsimp simp: prod_lift_def split: if_split) apply simp apply wp+ apply (rule hoare_strengthen_post) apply (subst archTcbUpdate_aux2[symmetric]) apply (rule threadSet_all_invs_triv'[where e=e]) apply (clarsimp simp: all_invs'_def) apply (rule exI, (rule conjI, assumption)+) subgoal by force apply simp apply (rule hoare_post_taut[where P=\<top>]) apply wp+ apply (clarsimp simp: all_invs'_def invs'_def cur_tcb'_def valid_state'_def) apply fastforce done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (kernelEntry_if e tc) (kernelEntry_C_if fp e tc) proof (prove)
using this:
no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (kernelEntry_if e tc)

goal (1 subgoal):
 1. corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (kernelEntry_if e tc) (kernelEntry_C_if fp e tc) proof (prove)
using this:
no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (kernelEntry_if e tc)

goal (1 subgoal):
 1. corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (kernelEntry_if e tc) (kernelEntry_C_if fp e tc) proof (prove)
goal (1 subgoal):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do t <- getCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) t;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do t <- getCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) t;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) (do t <- gets (ksCurThread_' \<circ> globals);
y <- setTCBContext_C (to_user_context_C tc) t;
y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (1 subgoal):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) (do ex <- do y <- do y <- gets (ksCurThread_' \<circ> globals) >>= setTCBContext_C (to_user_context_C tc);
exec_C \<Gamma> (callKernel_C_body_if e)
od;
gets ret__unsigned_long_'
od;
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (2 subgoals):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> no_fail (all_invs' e) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od)
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
return (r, tc)
od) (do ex <- do y <- do y <- gets (ksCurThread_' \<circ> globals) >>= setTCBContext_C (to_user_context_C tc);
exec_C \<Gamma> (callKernel_C_body_if e)
od;
gets ret__unsigned_long_'
od;
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s. all_invs' e s \<Longrightarrow> \<exists>sa. (sa, s) \<in> state_relation \<and> invs sa \<and> valid_list sa \<and> valid_sched sa \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running sa) \<and> scheduler_action sa = resume_cur_thread \<and> 0 < domain_time sa \<and> valid_domain_list sa \<and> invs' s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s) \<and> vs_valid_duplicates' (ksPSpace s) \<and> ksSchedulerAction s = ResumeCurrentThread
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
return (r, tc)
od) (do ex <- do y <- do y <- gets (ksCurThread_' \<circ> globals) >>= setTCBContext_C (to_user_context_C tc);
exec_C \<Gamma> (callKernel_C_body_if e)
od;
gets ret__unsigned_long_'
od;
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>(sa, s) \<in> state_relation; invs sa; valid_list sa; valid_sched_2 (ready_queues sa) (ekheap sa) resume_cur_thread (cur_domain sa) (kheap sa) (cur_thread sa) (idle_thread sa); e \<noteq> Interrupt \<longrightarrow> ct_running sa; ct_running sa \<or> ct_idle sa; scheduler_action sa = resume_cur_thread; 0 < domain_time sa; valid_domain_list sa; invs' s; vs_valid_duplicates' (ksPSpace s); e \<noteq> Interrupt \<longrightarrow> ct_running' s; ct_running' s \<or> ct_idle' s; ksDomainTime s \<noteq> 0; ksSchedulerAction s = ResumeCurrentThread\<rbrakk> \<Longrightarrow> \<exists>sa. (sa, s) \<in> state_relation \<and> invs sa \<and> valid_list sa \<and> valid_sched sa \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running sa) \<and> scheduler_action sa = resume_cur_thread \<and> 0 < domain_time sa \<and> valid_domain_list sa
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
return (r, tc)
od) (do ex <- do y <- do y <- gets (ksCurThread_' \<circ> globals) >>= setTCBContext_C (to_user_context_C tc);
exec_C \<Gamma> (callKernel_C_body_if e)
od;
gets ret__unsigned_long_'
od;
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>(sa, s) \<in> state_relation; invs sa; valid_list sa; valid_sched_2 (ready_queues sa) (ekheap sa) resume_cur_thread (cur_domain sa) (kheap sa) (cur_thread sa) (idle_thread sa); e \<noteq> Interrupt \<longrightarrow> ct_running sa; ct_running sa \<or> ct_idle sa; scheduler_action sa = resume_cur_thread; 0 < domain_time sa; valid_domain_list sa; invs' s; vs_valid_duplicates' (ksPSpace s); e \<noteq> Interrupt \<longrightarrow> ct_running' s; ct_running' s \<or> ct_idle' s; ksDomainTime s \<noteq> 0; ksSchedulerAction s = ResumeCurrentThread\<rbrakk> \<Longrightarrow> invs sa \<and> valid_list sa \<and> valid_sched sa \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running sa) \<and> scheduler_action sa = resume_cur_thread \<and> 0 < domain_time sa \<and> valid_domain_list sa
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
return (r, tc)
od) (do ex <- do y <- do y <- gets (ksCurThread_' \<circ> globals) >>= setTCBContext_C (to_user_context_C tc);
exec_C \<Gamma> (callKernel_C_body_if e)
od;
gets ret__unsigned_long_'
od;
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (1 subgoal):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do r <- do y <- getCurThread >>= threadSet (tcbArch_update (atcbContextSet tc));
handleEvent e
od;
return (r, tc)
od) (do ex <- do y <- do y <- gets (ksCurThread_' \<circ> globals) >>= setTCBContext_C (to_user_context_C tc);
exec_C \<Gamma> (callKernel_C_body_if e)
od;
gets ret__unsigned_long_'
od;
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (1 subgoal):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- getCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do x <- getCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
return (r, tc)
od) (do x <- gets (ksCurThread_' \<circ> globals);
y <- setTCBContext_C (to_user_context_C tc) x;
y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (1 subgoal):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (all_invs' e) (\<lambda>_. True) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
return (r, tc)
od) (do x <- gets (ksCurThread_' \<circ> globals);
y <- setTCBContext_C (to_user_context_C tc) x;
y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od) proof (prove)
goal (3 subgoals):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) ?Q29 ?Q'29 (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
return (r, tc)
od) (do x <- gets (ksCurThread_' \<circ> globals);
y <- setTCBContext_C (to_user_context_C tc) x;
y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 2. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ?Q29 s
 3. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ?Q'29 s proof (prove)
goal (6 subgoals):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> corres_underlying rf_sr False False (\<lambda>t t'. t' = tcb_ptr_to_ctcb_ptr t) (\<lambda>_. True) (\<lambda>_. True) (gets ksCurThread) (gets (ksCurThread_' \<circ> globals))
 2. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R33 x) (?R'33 xa) (do y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
return (r, tc)
od) (do y <- setTCBContext_C (to_user_context_C tc) xa;
y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>?R33\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>?R'33\<rbrace>
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (5 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R33 x) (?R'33 xa) (do y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
return (r, tc)
od) (do y <- setTCBContext_C (to_user_context_C tc) xa;
y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>?R33\<rbrace>
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>?R'33\<rbrace>
 4. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (8 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (?r'38 x xa) (?P39 x) (?P'41 xa) (threadSet (tcbArch_update (atcbContextSet tc)) x) (setTCBContext_C (to_user_context_C tc) xa)
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; ?r'38 x xa y ya\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R38 x xa y) (?R'38 x xa ya) (do r <- handleEvent e;
return (r, tc)
od) (do y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>?R38 x xa\<rbrace>
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>?R'38 x xa\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. ?P39 x and ?Q40 x\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. ?P'41 xa and ?Q'42 xa\<rbrace>
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (8 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (?r'49 x x xa xa) (?P50 x x) (?P'51 xa xa) (threadSet (\<lambda>tcb. tcbArch_update (\<lambda>_. atcbContextSet tc (tcbArch tcb)) tcb) x) (setTCBContext_C (to_user_context_C tc) xa)
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; ?r'49 x x xa xa y ya\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R38 x xa y) (?R'38 x xa ya) (do r <- handleEvent e;
return (r, tc)
od) (do y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>?R38 x xa\<rbrace>
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>?R'38 x xa\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. ?P50 x x and ?Q40 x\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. ?P'51 xa xa and ?Q'42 xa\<rbrace>
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (9 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> ccontext_relation tc (to_user_context_C tc)
 2. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> xa = tcb_ptr_to_ctcb_ptr x
 3. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R38 x xa y) (?R'38 x xa ya) (do r <- handleEvent e;
return (r, tc)
od) (do y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>?R38 x xa\<rbrace>
 5. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>?R'38 x xa\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 7. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 9. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (8 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> xa = tcb_ptr_to_ctcb_ptr x
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R38 x xa y) (?R'38 x xa ya) (do r <- handleEvent e;
return (r, tc)
od) (do y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>?R38 x xa\<rbrace>
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>?R'38 x xa\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (7 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R38 x xa y) (?R'38 x xa ya) (do r <- handleEvent e;
return (r, tc)
od) (do y <- exec_C \<Gamma> (callKernel_C_body_if e);
ex <- gets ret__unsigned_long_';
return (if ex = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl ex, tc)
od)
 2. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>?R38 x xa\<rbrace>
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>?R'38 x xa\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (11 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> ccorres (?r'56 x xa y ya) ret__unsigned_long_' (?P58 x xa y) (Collect (?P'60 x xa ya)) [] (handleEvent e) (callKernel_C_body_if e)
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> no_fail (?P58 x xa y) (handleEvent e)
 3. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; ?r'56 x xa y ya r rv'\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 4. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 5. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 6. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. ?P58 x xa y and ?Q59 x xa y\<rbrace>
 7. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 8. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 9. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 10. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> no_fail (?P58 x xa y) (handleEvent e)
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> ccorres (?r'56 x xa y ya) ret__unsigned_long_' (?P58 x xa y) (Collect (?P'60 x xa ya)) [] (handleEvent e) (callKernel_C_body_if e)
 3. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; ?r'56 x xa y ya r rv'\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 4. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 5. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 6. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. ?P58 x xa y and ?Q59 x xa y\<rbrace>
 7. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 8. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 9. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 10. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> corres_underlying (?state_relation68 x xa y) (?nf67 x xa y ya) True (?r67 x xa y ya) (?P69 x xa y) (?P'70 x xa y) (?f67 x xa y ya) (handleEvent e)
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; ?nf67 x xa y ya\<rbrakk> \<Longrightarrow> no_fail (?P69 x xa y) (?f67 x xa y ya)
 3. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> ccorres (?r'56 x xa y ya) ret__unsigned_long_' (\<lambda>s'. \<exists>s. (s, s') \<in> ?state_relation68 x xa y \<and> ?P69 x xa y s \<and> ?P'70 x xa y s') (Collect (?P'60 x xa ya)) [] (handleEvent e) (callKernel_C_body_if e)
 4. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; ?r'56 x xa y ya r rv'\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 5. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 6. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 7. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> ?state_relation68 x xa y \<and> ?P69 x xa y s \<and> ?P'70 x xa y s') and ?Q59 x xa y\<rbrace>
 8. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 9. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 10. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; False\<rbrakk> \<Longrightarrow> no_fail (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) (handle_event e)
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> ccorres (?r'56 x xa y ya) ret__unsigned_long_' (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') (Collect (?P'60 x xa ya)) [] (handleEvent e) (callKernel_C_body_if e)
 3. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; ?r'56 x xa y ya r rv'\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 4. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 5. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 6. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 7. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 8. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 9. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 10. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> ccorres (?r'56 x xa y ya) ret__unsigned_long_' (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') (Collect (?P'60 x xa ya)) [] (handleEvent e) (callKernel_C_body_if e)
 2. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; ?r'56 x xa y ya r rv'\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 3. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 4. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 5. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 6. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 7. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 8. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 9. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 10. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (12 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> ccorres (?r'56 x xa y ya) ret__unsigned_long_' (?Q76 x xa y ya) UNIV [] (handleEvent e) (callKernel_C_body_if e)
 2. \<And>x xa y ya s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; \<exists>sa. (sa, s) \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) sa \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s\<rbrakk> \<Longrightarrow> ?Q76 x xa y ya s
 3. \<And>x xa y ya s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; s \<in> Collect (?P'60 x xa ya)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 4. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; ?r'56 x xa y ya r rv'\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 5. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 6. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 7. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 8. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 9. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 10. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x xa y ya s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; \<exists>sa. (sa, s) \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) sa \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s\<rbrakk> \<Longrightarrow> (invs' and arch_extras and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s
 2. \<And>x xa y ya s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; s \<in> Collect (?P'60 x xa ya)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 3. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; (r = Inr ()) = (rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 4. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 5. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 6. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 7. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 8. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 9. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 10. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x xa y ya s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; s \<in> Collect (?P'60 x xa ya)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 2. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; (r = Inr ()) = (rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 3. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 4. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 5. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 6. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 7. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 8. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 9. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 10. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (9 subgoals):
 1. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; (r = Inr ()) = (rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (?R56 x xa y ya r) (?R'56 x xa y ya rv') (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>?R56 x xa y ya\<rbrace>
 3. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>?R'56 x xa y ya\<rbrace>
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 5. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 7. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 9. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (9 subgoals):
 1. \<And>x xa y ya r rv'. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya; (r = Inr ()) = (rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrakk> \<Longrightarrow> corres_underlying rf_sr False False (prod_lift (\<lambda>r r'. (r = Inr ()) = (r' = Inr ()))) (\<lambda>_. True) (\<lambda>_. True) (return (r, tc)) (return (if rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE then Inr () else Inl rv', tc))
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>\<lambda>rv' _. True\<rbrace>
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 5. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 7. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 9. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (8 subgoals):
 1. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x xa y\<rbrace> handleEvent e \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>\<lambda>rv' _. True\<rbrace>
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (8 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 x (tcb_ptr_to_ctcb_ptr x) ()\<rbrace> handleEvent e \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>x xa y ya. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'61 x xa ya\<rbrace> do y <- exec_C \<Gamma> (callKernel_C_body_if e);
gets ret__unsigned_long_'
od \<lbrace>\<lambda>rv' _. True\<rbrace>
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y. (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) s \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s') and ?Q59 x xa y\<rbrace>
 4. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and ?Q'61 x xa ya\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 6. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 8. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (6 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>\<lambda>y s. (\<exists>sa. (sa, s) \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) sa \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s) \<and> True\<rbrace>
 2. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and (\<lambda>_. True)\<rbrace>
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (7 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x\<rbrace> threadSet (tcbArch_update (atcbContextSet tc)) x \<lbrace>?Q114 x xa\<rbrace>
 2. \<And>x xa rv s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; ?Q114 x xa rv s\<rbrakk> \<Longrightarrow> (\<exists>sa. (sa, s) \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) sa \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s) \<and> True
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and (\<lambda>_. True)\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q40 x\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (7 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 x x\<rbrace> threadSet (\<lambda>tcb. tcbArch_update (\<lambda>_. atcbContextSet tc (tcbArch tcb)) tcb) x \<lbrace>?Qa120 x x xa (?xa118 x xa)\<rbrace>
 2. \<And>x xa rv s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; ?Qa120 x x xa (?xa118 x xa) rv s\<rbrakk> \<Longrightarrow> (\<exists>sa. (sa, s) \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) sa \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s) \<and> True
 3. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and (\<lambda>_. True)\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and ?Q119 x x\<rbrace>
 5. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 7. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (6 subgoals):
 1. \<And>x xa rv s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x; all_invs' e s\<rbrakk> \<Longrightarrow> (\<exists>sa. (sa, s) \<in> state_relation \<and> (einvs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s) and (\<lambda>s. scheduler_action s = resume_cur_thread)) sa \<and> (invs' and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running' s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)) s) \<and> True
 2. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and (\<lambda>_. True)\<rbrace>
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and (all_invs' e and (\<lambda>s. x = ksCurThread s))\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); (sa, s) \<in> state_relation; invs sa; valid_list sa; valid_sched_2 (ready_queues sa) (ekheap sa) resume_cur_thread (cur_domain sa) (kheap sa) (cur_thread sa) (idle_thread sa); e \<noteq> Interrupt \<longrightarrow> ct_running sa; ct_running sa \<or> ct_idle sa; scheduler_action sa = resume_cur_thread; 0 < domain_time sa; valid_domain_list sa; invs' s; vs_valid_duplicates' (ksPSpace s); e \<noteq> Interrupt \<longrightarrow> ct_running' s; ct_running' s \<or> ct_idle' s; ksDomainTime s \<noteq> 0; ksSchedulerAction s = ResumeCurrentThread\<rbrakk> \<Longrightarrow> \<exists>sa. (sa, s) \<in> state_relation \<and> invs sa \<and> valid_list sa \<and> valid_sched sa \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running sa) \<and> scheduler_action sa = resume_cur_thread
 2. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and (\<lambda>_. True)\<rbrace>
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and (all_invs' e and (\<lambda>s. x = ksCurThread s))\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); (sa, s) \<in> state_relation; invs sa; valid_list sa; valid_sched_2 (ready_queues sa) (ekheap sa) resume_cur_thread (cur_domain sa) (kheap sa) (cur_thread sa) (idle_thread sa); e \<noteq> Interrupt \<longrightarrow> ct_running sa; ct_running sa \<or> ct_idle sa; scheduler_action sa = resume_cur_thread; 0 < domain_time sa; valid_domain_list sa; invs' s; vs_valid_duplicates' (ksPSpace s); e \<noteq> Interrupt \<longrightarrow> ct_running' s; ct_running' s \<or> ct_idle' s; ksDomainTime s \<noteq> 0; ksSchedulerAction s = ResumeCurrentThread\<rbrakk> \<Longrightarrow> valid_sched sa \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running sa) \<and> scheduler_action sa = resume_cur_thread
 2. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and (\<lambda>_. True)\<rbrace>
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and (all_invs' e and (\<lambda>s. x = ksCurThread s))\<rbrace>
 4. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 6. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); (sa_, s_) \<in> state_relation; invs sa_; valid_list sa_; valid_sched_2 (ready_queues sa_) (ekheap sa_) resume_cur_thread (cur_domain sa_) (kheap sa_) (cur_thread sa_) (idle_thread sa_); e \<noteq> Interrupt \<longrightarrow> ct_running sa_; ct_running sa_ \<or> ct_idle sa_; scheduler_action sa_ = resume_cur_thread; 0 < domain_time sa_; valid_domain_list sa_; invs' s_; vs_valid_duplicates' (ksPSpace s_); e \<noteq> Interrupt \<longrightarrow> ct_running' s_; ct_running' s_ \<or> ct_idle' s_; ksDomainTime s_ \<noteq> 0; ksSchedulerAction s_ = ResumeCurrentThread\<rbrakk> \<Longrightarrow> valid_sched sa_ \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running sa_) \<and> scheduler_action sa_ = resume_cur_thread proof (prove)
goal (5 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 xa\<rbrace> setTCBContext_C (to_user_context_C tc) xa \<lbrace>\<lambda>ya. ?P'60 x xa ya and (\<lambda>_. True)\<rbrace>
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and (all_invs' e and (\<lambda>s. x = ksCurThread s))\<rbrace>
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 4. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (5 subgoals):
 1. \<And>x xa. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); xa = tcb_ptr_to_ctcb_ptr x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 (tcb_ptr_to_ctcb_ptr x)\<rbrace> setTCBContext_C (to_user_context_C tc) (tcb_ptr_to_ctcb_ptr x) \<lbrace>?P'60 x (tcb_ptr_to_ctcb_ptr x)\<rbrace>
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and (all_invs' e and (\<lambda>s. x = ksCurThread s))\<rbrace>
 3. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and ?Q'42 xa\<rbrace>
 4. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 5. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (4 subgoals):
 1. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q33\<rbrace> gets ksCurThread \<lbrace>\<lambda>x. pspace_domain_valid and tcb_at' x and (all_invs' e and (\<lambda>s. x = ksCurThread s))\<rbrace>
 2. no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od) \<Longrightarrow> \<lbrace>?Q'33\<rbrace> gets (ksCurThread_' \<circ> globals) \<lbrace>\<lambda>xa. (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q33) s
 4. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'33) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); all_invs' e s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (pspace_domain_valid and tcb_at' (ksCurThread s) and (all_invs' e and (\<lambda>sa. ksCurThread s = ksCurThread sa))) s)) s
 2. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>a. True) and (\<lambda>a. True))) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>no_fail (\<lambda>s'. \<exists>s. (s, s') \<in> state_relation \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running s) \<and> scheduler_action s = resume_cur_thread \<and> 0 < domain_time s \<and> valid_domain_list s \<and> invs' s' \<and> (e \<noteq> Interrupt \<longrightarrow> ct_running' s') \<and> vs_valid_duplicates' (ksPSpace s') \<and> ksSchedulerAction s' = ResumeCurrentThread) (do x <- gets ksCurThread;
y <- threadSet (tcbArch_update (atcbContextSet tc)) x;
r <- handleEvent e;
y <- stateAssert (\<lambda>s. valid_domain_list' s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < ksDomainTime s) \<and> (e = Interrupt \<longrightarrow> ksDomainTime s = 0 \<longrightarrow> ksSchedulerAction s = ChooseNewThread)) [];
return (r, tc)
od); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>a. True) and (\<lambda>a. True))) s proof (prove)
goal:
No subgoals!