theory Tcb_C

lemma decodeReadRegisters_ccorres:
  "ccorres (intr_and_se_rel \<currency> dc)  (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active'
              and sysargs_rel args buffer
              and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp)
              and K (isThreadCap cp))
       (UNIV
            \<inter> {s. ccap_relation cp (cap_' s)}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. call_' s = from_bool isCall}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (decodeReadRegisters args cp
            >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeReadRegisters_'proc)" apply (cinit' lift: cap_' length___unsigned_long_' call_' buffer_') apply (simp add: decodeReadRegisters_def decodeTransfer_def
               del: Collect_const cong: list.case_cong) apply wpc apply (drule word_unat.Rep_inverse') apply (simp add: throwError_bind invocationCatch_def
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply wpc apply (drule word_unat.Rep_inverse') apply (simp add: throwError_bind invocationCatch_def
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: word_less_nat_alt Collect_False del: Collect_const) apply (rule ccorres_add_return,
          ctac add: getSyscallArg_ccorres_foo[where args=args and n=0 and buffer=buffer]) apply (rule ccorres_add_return,
            ctac add: getSyscallArg_ccorres_foo[where args=args and n=1 and buffer=buffer]) apply (rule ccorres_move_const_guards)+ apply (simp add: rangeCheck_def unlessE_whenE whenE_def if_to_top_of_bindE
                        ccorres_seq_cond_raise if_to_top_of_bind
                   del: Collect_const) apply (rule ccorres_cond2[where R=\<top>]) apply (simp add: frame_gp_registers_convs n_frameRegisters_def
                          n_gpRegisters_def Collect_const_mem) apply unat_arith apply (simp add: throwError_bind invocationCatch_def
                   cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def intr_and_se_rel_def
                              syscall_error_rel_def syscall_error_to_H_cases
                              exception_defs Collect_const_mem) apply (simp add: frame_gp_registers_convs n_frameRegisters_def
                         n_gpRegisters_def) apply (simp add: ccorres_invocationCatch_Inr returnOk_bind
                        performInvocation_def
                   del: Collect_const) apply csymbr apply csymbr apply csymbr apply (simp add: liftE_bindE bind_assoc) apply (rule ccorres_pre_getCurThread) apply (rule ccorres_cond_seq) apply (rule_tac R="\<lambda>s. self = ksCurThread s \<and> isThreadCap cp" and P="\<lambda>s. capTCBPtr cp = self"
                in ccorres_cond_both) apply clarsimp apply (frule rf_sr_ksCurThread) apply clarsimp apply (frule (1) cap_get_tag_isCap[symmetric, THEN iffD1]) apply (drule (1) cap_get_tag_to_H) apply clarsimp apply (rule iffI) apply (drule_tac t="ksCurThread s" in sym) apply simp apply simp apply (rule_tac P="capTCBPtr cp = self" in ccorres_gen_asm) apply simp apply (simp add: throwError_bind invocationCatch_def
                    cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (rule_tac P="capTCBPtr cp \<noteq> self" in ccorres_gen_asm) apply (simp add: returnOk_bind) apply (simp add: ccorres_invocationCatch_Inr del: Collect_const) apply (ctac add: setThreadState_ccorres) apply csymbr apply (rule ccorres_Guard_Seq)+ apply (rule ccorres_nondet_refinement) apply (rule is_nondet_refinement_bindE) apply (rule is_nondet_refinement_refl) apply (simp split: if_split, rule conjI[rotated]) apply (rule impI, rule is_nondet_refinement_refl) apply (rule impI, rule is_nondet_refinement_alternative1) apply (simp add: performInvocation_def) apply (rule ccorres_add_returnOk) apply (ctac(no_vcg) add: invokeTCB_ReadRegisters_ccorres) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (wp ct_in_state'_set sts_invs_minor') apply (simp add: Collect_const_mem intr_and_se_rel_def
                        cintr_def exception_defs) apply (vcg exspec=setThreadState_modifies) apply wp apply (vcg exspec=getSyscallArg_modifies) apply wp apply (vcg exspec=getSyscallArg_modifies) apply (clarsimp simp: Collect_const_mem rf_sr_ksCurThread
                        "StrictC'_thread_state_defs" word_sless_def word_sle_def
                        mask_eq_iff_w2p word_size isCap_simps
                        ReadRegistersFlags_defs tcb_at_invs'
                        cap_get_tag_isCap capTCBPtr_eq) apply (frule global'_no_ex_cap[OF invs_valid_global'], clarsimp) apply (rule conjI) apply clarsimp apply (rule conjI, clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (rule conjI, clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (auto simp: ct_in_state'_def n_frameRegisters_def n_gpRegisters_def
                     valid_tcb_state'_def
              elim!: pred_tcb'_weakenE
              dest!: st_tcb_at_idle_thread')[1] apply (clarsimp simp: word_and_1 split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and K (isThreadCap cp)) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeReadRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeReadRegisters_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla length___unsigned_long cap. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2648 buffera calla length___unsigned_long cap) (?Q'2648 buffera calla length___unsigned_long cap) [SKIP] (decodeReadRegisters args cp >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>n :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>flags && (1 << unat ReadRegisters_suspend),\<acute>n,\<acute>transferArch,calla)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2648 buffera calla length___unsigned_long cap s \<and> s' \<in> ?Q'2648 buffera calla length___unsigned_long cap proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla length___unsigned_long cap. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2648 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap) (?Q'2648 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [flags] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | flags # n # x \<Rightarrow> doE y <- rangeCheck n (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (flags !! 0) n copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2648 buffera calla length___unsigned_long cap s \<and> s' \<in> ?Q'2648 buffera calla length___unsigned_long cap proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2673 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap) (?R''2676 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2672 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap a x21 x22) (?R''2674 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) [SKIP] ((case x22 of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | n # x \<Rightarrow> doE y <- rangeCheck n (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) n copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R2673 buffera calla length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2672 buffera calla length___unsigned_long cap s x xa)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> ?R''2676 buffera calla length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2674 buffera calla length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; ccap_relation cp cap; args = []; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2673 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap) (?R''2676 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2672 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap a x21 x22) (?R''2674 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) [SKIP] ((case x22 of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | n # x \<Rightarrow> doE y <- rangeCheck n (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) n copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R2673 buffera calla length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2672 buffera calla length___unsigned_long cap s x xa)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> ?R''2676 buffera calla length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2674 buffera calla length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; ccap_relation cp cap; args = []; length___unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2673 (option_to_ptr buffer) (from_bool isCall) 0 cap) (?R''2676 (option_to_ptr buffer) (from_bool isCall) 0 cap) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError));;
\<acute>globals :== current_syscall_error_'_update (rangeErrorMin_C_update (\<lambda>_. 1));;
Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2672 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap a x21 x22) (?R''2674 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) [SKIP] ((case x22 of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | n # x \<Rightarrow> doE y <- rangeCheck n (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) n copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R2673 buffera calla length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2672 buffera calla length___unsigned_long cap s x xa)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> ?R''2676 buffera calla length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2674 buffera calla length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap err' ft'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; ccap_relation cp cap; args = []; length___unsigned_long = 0\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2672 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap a x21 x22) (?R''2674 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) [SKIP] ((case x22 of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | n # x \<Rightarrow> doE y <- rangeCheck n (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) n copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2672 buffera calla length___unsigned_long cap s x xa)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2674 buffera calla length___unsigned_long cap x xa}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2672 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap a x21 x22) (?R''2674 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) [SKIP] ((case x22 of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | n # x \<Rightarrow> doE y <- rangeCheck n (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) n copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2672 buffera calla length___unsigned_long cap s x xa)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2674 buffera calla length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; x22 = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2710 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) (?R''2713 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2709 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 a x21a x22a) (?R''2711 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> ?R2710 buffera calla length___unsigned_long cap x xa s) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> ?R2709 buffera calla length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> ?R''2713 buffera calla length___unsigned_long cap x xa} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> ?R''2711 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; ccap_relation cp cap; args = x21 # x22; x22 = []; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2710 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) (?R''2713 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2709 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 a x21a x22a) (?R''2711 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> ?R2710 buffera calla length___unsigned_long cap x xa s) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> ?R2709 buffera calla length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> ?R''2713 buffera calla length___unsigned_long cap x xa} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> ?R''2711 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; ccap_relation cp cap; args = [x21]; x22 = []; length___unsigned_long = 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2710 (option_to_ptr buffer) (from_bool isCall) 1 cap x21 []) (?R''2713 (option_to_ptr buffer) (from_bool isCall) 1 cap x21 []) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError));;
\<acute>globals :== current_syscall_error_'_update (rangeErrorMin_C_update (\<lambda>_. 1));;
Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2709 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 a x21a x22a) (?R''2711 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> ?R2710 buffera calla length___unsigned_long cap x xa s) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> ?R2709 buffera calla length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> ?R''2713 buffera calla length___unsigned_long cap x xa} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> ?R''2711 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 err' ft'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; ccap_relation cp cap; args = [x21]; x22 = []; length___unsigned_long = 1\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2709 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 a x21a x22a) (?R''2711 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> ?R2709 buffera calla length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> ?R''2711 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2709 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 a x21a x22a) (?R''2711 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 2 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> ?R2709 buffera calla length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> ?R''2711 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R2709 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) a x21a x22a) (?R''2711 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> ?R2709 buffera calla length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> ?R''2711 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2741 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv) (?Q'2741 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF \<acute>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<acute>n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,\<acute>n)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>?Q2741 buffera calla length___unsigned_long cap x21 x22 x21a x22a\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'2741 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 4. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0; n = args ! 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva) (?Q'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva n) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,n)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>?Q3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> ?Q'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0; n = args ! 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3488 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva) (?Q'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva n) [SKIP] (doE y <- rangeCheck x21a (Suc 0) (length TCB_H.frameRegisters + length TCB_H.gpRegisters);
self <- liftE getCurThread;
y <- whenE (capTCBPtr cp = self) (throwError Fault_H.syscall_error.IllegalOperation);
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat n THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,flags && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,n)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. ?P3488 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> ?Q'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3488 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Q'3139 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (if 1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters) then doE y <- throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)));
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB else doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF x21a = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat x21a THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
ELSE
  SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
FI)
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. ?P3488 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> ?Q'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) = (s' \<in> \<lbrace>x21a = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat x21a\<rbrace>)
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt3511 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rt3507 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)));
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pt3511 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rt3507 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> (\<exists>s s'. (s, s') \<in> rf_sr) \<longrightarrow> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> 0x13) = (x21a = 0 \<or> 19 < unat x21a)
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt3511 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rt3507 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)));
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pt3511 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rt3507 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt3511 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rt3507 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- throwError (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)));
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== rangeErrorMin_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>current_syscall_error :== rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pt3511 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rt3507 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt3511 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rt3507 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (throwError (Inl (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters))))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError));;
\<acute>globals :== current_syscall_error_'_update (rangeErrorMin_C_update (\<lambda>_. 1));;
Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pt3511 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rt3507 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3593 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError));;
\<acute>globals :== current_syscall_error_'_update (rangeErrorMin_C_update (\<lambda>_. 1));;
Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n \<sigma>. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError));;
\<acute>globals :== current_syscall_error_'_update (rangeErrorMin_C_update (\<lambda>_. 1));;
Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> ?R'3593 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s)) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n \<sigma>. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError));;
\<acute>globals :== current_syscall_error_'_update (rangeErrorMin_C_update (\<lambda>_. 1));;
Guard SignedArithmetic (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Inl (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n \<sigma>. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. globals_update (current_syscall_error_'_update (\<lambda>x. rangeErrorMin_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) x))) s \<in> (if - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 then UNIV else {}) \<and> (\<exists>(rv, \<sigma>')\<in>fst (throwError (Inl (Fault_H.syscall_error.RangeError 1 (word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)))) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>x. rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) (rangeErrorMin_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) x)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>x. rangeErrorMax_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) (rangeErrorMin_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RangeError) x)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>)))}
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a \<sigma> x. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<and> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) = word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE y <- returnOk ();
self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?Rf3505 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a) [SKIP] (doE self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,\<acute>transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> ?Rf3505 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s))}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?G'3656 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a transferArch) [SKIP] (doE self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> ?G'3656 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?G'3899 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a transferArch ret__unsigned) [SKIP] (doE self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>thread :== tcb_Ptr ret__unsigned;;
(IF \<acute>thread = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'3899 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?G'4066 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a transferArch ret__unsigned) [SKIP] (doE self <- liftE getCurThread;
if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF tcb_Ptr ret__unsigned = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s ReadRegisters_suspend\<rbrace> (Guard ShiftError \<lbrace>ReadRegisters_suspend <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,transferArch,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4066 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf3509 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 ()) (?G'4066 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (do self <- getCurThread;
(if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> ?Pf3509 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4066 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P4248 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () a self) (?P'4249 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ?P4248 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva s rvb)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?P'4249 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4255 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?P'4249 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = \<acute>ksCurThread THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
ELSE
  SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
FI)
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ?P4255 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?P'4249 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> self = ksCurThread s \<and> isThreadCap cp \<longrightarrow> (capTCBPtr cp = self) = (s' \<in> \<lbrace>tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = \<acute>ksCurThread\<rbrace>)
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap cp\<rbrakk> \<Longrightarrow> (capTCBPtr cp = ksCurThread s) = (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = ksCurThread_' (globals s'))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap cp; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> (capTCBPtr cp = ksCurThread s) = (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = ksCurThread_' (globals s'))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap cp; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> (capTCBPtr cp = ksCurThread s) = (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap cp; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrakk> \<Longrightarrow> (capTCBPtr cp = ksCurThread s) = (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap cp; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))\<rbrakk> \<Longrightarrow> (capTCBPtr cp = ksCurThread s) = (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))\<rbrakk> \<Longrightarrow> (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) = ksCurThread s) = (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) = ksCurThread s\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s)
 2. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) = ksCurThread s
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 9. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); ksCurThread s = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))\<rbrakk> \<Longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s)
 2. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) = ksCurThread s
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 9. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x21a x22a s s'. \<lbrakk>unat length___unsigned_long = Suc (Suc (length x22a)); args = x21 # x21a # x22a; (s, s') \<in> rf_sr; isThreadCap (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) = ksCurThread s
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt4268 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ?Pt4268 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp = self\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4305 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> (?G4305 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp = self\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4305 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> (?G4305 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp = self\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4305 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rt4261 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> (?G4305 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> ?Rt4261 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self err' ft'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp = self\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf4266 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ?Pf4266 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4322 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] ((if capTCBPtr cp = self then doE y <- throwError Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE else doE y <- returnOk ();
returnOk (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> (?G4322 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4322 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters))) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> (?G4322 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4322 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self) (?Rf4260 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> (?G4322 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> ?Rf4260 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv xfdc. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv) (?Q'4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv xfdc) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s)}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?G'4388 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (Guard ShiftError (if 0 \<le>s ReadRegisters_suspend then UNIV else {}) (Guard ShiftError (if ReadRegisters_suspend <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a)));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'4388 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> is_nondet_refinement (?a4480 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE)
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (?a4480 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 9. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> is_nondet_refinement (?a4483 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) (global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned rva. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> is_nondet_refinement (?b4483 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned rva) (if rva = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rva isCall))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (?a4483 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned >>=E ?b4483 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 9. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 10. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned rva. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> is_nondet_refinement (?b4483 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned rva) (if rva = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rva isCall))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)) >>=E ?b4483 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 9. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned rva. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> rva \<noteq> [] \<longrightarrow> is_nondet_refinement (?b4483 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a x21 x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (liftE (replyOnRestart thread rva isCall))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned rva. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> rva = [] \<longrightarrow> is_nondet_refinement (?b4483 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a x21 x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) []) (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ())
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters)) >>=E ?b4483 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 9. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 10. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned rva. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> rva = [] \<longrightarrow> is_nondet_refinement (liftE (replyOnRestart thread [] isCall)) (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ())
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (doE a <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters));
liftE (replyOnRestart thread a isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 9. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv) (?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self rv xfdc ret__unsigned) [SKIP] (doE a <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters));
liftE (replyOnRestart thread a isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr ret__unsigned,x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a x21 x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self ()) (?C'4478 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a x21 x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (doE a <- invokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters);
liftE (replyOnRestart thread a isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4338 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4478 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4502 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self ()) (?C'4504 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (doE a <- invokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters);
liftE (replyOnRestart thread a isCall)
odE >>=E returnOk) (\<acute>ret__unsigned_long :== CALL invokeTCB_ReadRegisters_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),x21 && 2 ^ unat ReadRegisters_suspend,0,from_bool isCall,x21a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4502 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'4504 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self rv (xfdc s) v \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned rv ret__unsigned_long. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); dc rv (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4510 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned rv) (?Q'4530 length___unsigned_long cap x21 x21a x22a self xfdc rv ret__unsigned_long) [SKIP] (returnOk rv) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (intr_and_se_rel \<circ> Inr) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4510 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned err) (?Q''4528 length___unsigned_long cap x21 x21a x22a self xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R4522 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self ()\<rbrace> doE a <- invokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters);
liftE (replyOnRestart thread a isCall)
odE \<lbrace>?Q4510 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned\<rbrace>, \<lbrace>?QE4510 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' (capTCBPtr cp) and sch_act_simple and (\<lambda>s. capTCBPtr cp \<noteq> ksIdleThread s) and (\<lambda>_. capTCBPtr cp \<noteq> thread) and ?R4522 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. n_'_update (\<lambda>x. n) (call_'_update (\<lambda>_. calla) (arch_'_update (\<lambda>_. transferArch) (suspendSource_'_update (\<lambda>_. flags && 2 ^ unat ReadRegisters_suspend) (tcb_src_'_update (\<lambda>_. tcb_Ptr v) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool (flags !! 0)\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' t)) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'4529 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self rv (xfdc s) v t rva)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''4527 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self rv (xfdc s) v t err))} \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 9. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 10. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x21a x22a self xfdc t rv. ?Q'4530 length___unsigned_long cap x21 x21a x22a self xfdc rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x21a x22a self xfdc. ?Q'4529 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))
\<lambda>length___unsigned_long cap x21 x21a x22a self xfdc t err. ?Q''4528 length___unsigned_long cap x21 x21a x22a self xfdc err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x21a x22a self xfdc. ?Q''4527 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) proof (prove)
goal (9 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (intr_and_se_rel \<circ> Inr) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4510 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned err) (?Q''4528 length___unsigned_long cap x21 x21a x22a self xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R4522 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self ()\<rbrace> doE a <- invokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters);
liftE (replyOnRestart thread a isCall)
odE \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE4510 buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' (capTCBPtr cp) and sch_act_simple and (\<lambda>s. capTCBPtr cp \<noteq> ksIdleThread s) and (\<lambda>_. capTCBPtr cp \<noteq> thread) and ?R4522 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self a\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. n_'_update (\<lambda>x. n) (call_'_update (\<lambda>_. calla) (arch_'_update (\<lambda>_. transferArch) (suspendSource_'_update (\<lambda>_. flags && 2 ^ unat ReadRegisters_suspend) (tcb_src_'_update (\<lambda>_. tcb_Ptr v) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool (flags !! 0)\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' t)) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''4527 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self rv (xfdc s) v t err))} \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 8. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 9. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x21a x22a self xfdc t err. ?Q''4528 length___unsigned_long cap x21 x21a x22a self xfdc err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x21a x22a self xfdc. ?Q''4527 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) proof (prove)
goal (8 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigneda self xfdc ret__unsigned. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigneda = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R4522 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21 x21a x21a x22a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self ()\<rbrace> doE a <- invokeTCB (tcbinvocation.ReadRegisters (capTCBPtr cp) (x21 !! 0) x21a copy_register_sets.ARMNoExtraRegisters);
liftE (replyOnRestart thread a isCall)
odE \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' (capTCBPtr cp) and sch_act_simple and (\<lambda>s. capTCBPtr cp \<noteq> ksIdleThread s) and (\<lambda>_. capTCBPtr cp \<noteq> thread) and ?R4522 buffera calla length___unsigned_long cap x21 x22 flags x21a n x22a transferArch ret__unsigned self a\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. n_'_update (\<lambda>x. n) (call_'_update (\<lambda>_. calla) (arch_'_update (\<lambda>_. transferArch) (suspendSource_'_update (\<lambda>_. flags && 2 ^ unat ReadRegisters_suspend) (tcb_src_'_update (\<lambda>_. tcb_Ptr v) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool (flags !! 0)\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))} \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 7. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 8. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<lbrace>?R4346 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () self\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' (capTCBPtr cp) and sch_act_simple and (\<lambda>s. capTCBPtr cp \<noteq> ksIdleThread s) and (\<lambda>_. capTCBPtr cp \<noteq> thread) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. n_'_update (\<lambda>x. n) (call_'_update (\<lambda>_. calla) (arch_'_update (\<lambda>_. transferArch) (suspendSource_'_update (\<lambda>_. flags && 2 ^ unat ReadRegisters_suspend) (tcb_src_'_update (\<lambda>_. tcb_Ptr v) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool (flags !! 0)\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))} \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rvb. ksCurThread s = rvb \<longrightarrow> ((\<lambda>s. rvb = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rvb \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rvb)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rvb \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4346 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva rvb and (\<lambda>_. capTCBPtr cp \<noteq> rvb)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 6. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 7. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. n_'_update (\<lambda>x. n) (call_'_update (\<lambda>_. calla) (arch_'_update (\<lambda>_. transferArch) (suspendSource_'_update (\<lambda>_. flags && 2 ^ unat ReadRegisters_suspend) (tcb_src_'_update (\<lambda>_. tcb_Ptr v) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool (flags !! 0)\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rva (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))} \<inter> (if ReadRegisters_suspend <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ReadRegisters_suspend then UNIV else {})}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rv)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rv \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<and> Structures_H.thread_state.Restart = Structures_H.thread_state.Restart \<and> thread = ksCurThread a) \<and> tcb_at' (capTCBPtr cp) a \<and> sch_act_simple a \<and> capTCBPtr cp \<noteq> ksIdleThread a \<and> capTCBPtr cp \<noteq> thread \<and> True \<and> True) and (\<lambda>_. capTCBPtr cp \<noteq> rv)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a flags n transferArch ret__unsigned self. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = x21; n = x21a; transferArch = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); capTCBPtr cp \<noteq> self\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4339 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a () x21 () x21a 0 (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) self) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 && 2 ^ unat ReadRegisters_suspend = from_bool (x21 !! 0) \<and> ReadRegisters_suspend <s 0x20 \<and> 0 \<le>s ReadRegisters_suspend \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rv)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rv \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<and> Structures_H.thread_state.Restart = Structures_H.thread_state.Restart \<and> thread = ksCurThread a) \<and> tcb_at' (capTCBPtr cp) a \<and> sch_act_simple a \<and> capTCBPtr cp \<noteq> ksIdleThread a \<and> capTCBPtr cp \<noteq> thread \<and> True \<and> True) and (\<lambda>_. capTCBPtr cp \<noteq> rv)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. thread_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {sa. \<forall>rvb. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rvb \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4339 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags rva (n_' s) v va rvb \<inter> - \<lbrace>tcb_Ptr va = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 5. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 6. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> return () \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rv)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rv \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<and> Structures_H.thread_state.Restart = Structures_H.thread_state.Restart \<and> thread = ksCurThread a) \<and> tcb_at' (capTCBPtr cp) a \<and> sch_act_simple a \<and> capTCBPtr cp \<noteq> ksIdleThread a \<and> capTCBPtr cp \<noteq> thread \<and> True \<and> True) and (\<lambda>_. capTCBPtr cp \<noteq> rv)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)\<rbrace>
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rv. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {s. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>tcb_Ptr v = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> flags && 2 ^ unat ReadRegisters_suspend = from_bool (flags !! 0) \<and> ReadRegisters_suspend <s 0x20 \<and> 0 \<le>s ReadRegisters_suspend \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})} \<inter> - \<lbrace>tcb_Ptr v = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R3141 buffera calla length___unsigned_long cap x21 x22 x21a x22a a\<rbrace>
 4. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 5. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv flags) \<acute>n :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rv. n_' s = args ! 1 \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>\<^bsup>s\<^esup>n = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat \<^bsup>s\<^esup>n\<rbrace> \<longrightarrow> sa \<in> {s. \<forall>v. v = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>tcb_Ptr v = \<acute>ksCurThread\<rbrace> \<union> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> flags && 2 ^ unat ReadRegisters_suspend = from_bool (flags !! 0) \<and> ReadRegisters_suspend <s 0x20 \<and> 0 \<le>s ReadRegisters_suspend \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})} \<inter> - \<lbrace>tcb_Ptr v = \<acute>ksCurThread\<rbrace>}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}})}}
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ((\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rv)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rv \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<and> Structures_H.thread_state.Restart = Structures_H.thread_state.Restart \<and> thread = ksCurThread a) \<and> tcb_at' (capTCBPtr cp) a \<and> sch_act_simple a \<and> capTCBPtr cp \<noteq> ksIdleThread a \<and> capTCBPtr cp \<noteq> thread \<and> True \<and> True) and (\<lambda>_. capTCBPtr cp \<noteq> rv)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647))\<rbrace>
 3. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'3139 buffera calla length___unsigned_long cap x21 x22 x21a x22a rv (flags_' s)}
 4. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ((\<lambda>_. True) and (\<lambda>s. (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x21a \<longrightarrow> \<not> x21a \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rv)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rv \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<and> Structures_H.thread_state.Restart = Structures_H.thread_state.Restart \<and> thread = ksCurThread a) \<and> tcb_at' (capTCBPtr cp) a \<and> sch_act_simple a \<and> capTCBPtr cp \<noteq> ksIdleThread a \<and> capTCBPtr cp \<noteq> thread \<and> True \<and> True) and (\<lambda>_. capTCBPtr cp \<noteq> rv)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647))\<rbrace>
 2. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> {sa. \<forall>t. ret__unsigned_long_' t = args ! 1 \<longrightarrow> \<not> (args ! 1 = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat (args ! 1)) \<longrightarrow> (\<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr rv \<or> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> tcb_ptr_to_ctcb_ptr rv = tcb_ptr_to_ctcb_ptr thread \<and> (\<forall>t. sa\<lparr>n_' := args ! 1, transferArch_' := 0, ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), thread_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> flags_' s && 2 ^ unat ReadRegisters_suspend = from_bool (flags_' s !! 0) \<and> ReadRegisters_suspend <s 0x20 \<and> 0 \<le>s ReadRegisters_suspend \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<noteq> tcb_ptr_to_ctcb_ptr rv) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R2749 buffera calla length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera calla length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = Suc (Suc (length x22a)); ccap_relation cp cap; args = x21 # x21a # x22a; x22 = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2742 (option_to_ptr buffer) (from_bool isCall) length___unsigned_long cap x21 (x21a # x22a) x21a x22a) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> {sa. \<forall>t. ret__unsigned_long_' t = args ! 1 \<longrightarrow> \<not> (args ! 1 = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat (args ! 1)) \<longrightarrow> (\<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr rv \<or> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> tcb_ptr_to_ctcb_ptr rv = tcb_ptr_to_ctcb_ptr thread \<and> (\<forall>t. sa\<lparr>n_' := args ! 1, transferArch_' := 0, ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), thread_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> flags_' s && 2 ^ unat ReadRegisters_suspend = from_bool (flags_' s !! 0) \<and> ReadRegisters_suspend <s 0x20 \<and> 0 \<le>s ReadRegisters_suspend \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<noteq> tcb_ptr_to_ctcb_ptr rv) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>x xb. xa = x # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ((\<lambda>_. True) and (\<lambda>s. (1 \<le> x \<longrightarrow> \<not> x \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x \<longrightarrow> \<not> x \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rv)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rv \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<and> Structures_H.thread_state.Restart = Structures_H.thread_state.Restart \<and> thread = ksCurThread a) \<and> tcb_at' (capTCBPtr cp) a \<and> sch_act_simple a \<and> capTCBPtr cp \<noteq> ksIdleThread a \<and> capTCBPtr cp \<noteq> thread \<and> True \<and> True) and (\<lambda>_. capTCBPtr cp \<noteq> rv)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)))) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. xa = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'2742 buffera calla length___unsigned_long cap x xa xb xc}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>buffera calla length___unsigned_long cap s s'. \<lbrakk>buffera = option_to_ptr buffer; calla = from_bool isCall; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and sysargs_rel args buffer and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>x xb. xa = x # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ((\<lambda>_. True) and (\<lambda>s. (1 \<le> x \<longrightarrow> \<not> x \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> True) and (\<lambda>s. \<not> (1 \<le> x \<longrightarrow> \<not> x \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters)) \<longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>s. rv = ksCurThread s \<and> isThreadCap cp) and (\<lambda>s. capTCBPtr cp = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. capTCBPtr cp = rv)) s) and (\<lambda>s. capTCBPtr cp \<noteq> rv \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<and> Structures_H.thread_state.Restart = Structures_H.thread_state.Restart \<and> thread = ksCurThread a) \<and> tcb_at' (capTCBPtr cp) a \<and> sch_act_simple a \<and> capTCBPtr cp \<noteq> ksIdleThread a \<and> capTCBPtr cp \<noteq> thread \<and> True \<and> True) and (\<lambda>_. capTCBPtr cp \<noteq> rv)) s)) s)) and K (- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)))) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. xa = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xb. s \<in> {s. xa = x # xb \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t = args ! 0 \<longrightarrow> unat 1 = 1 \<and> (\<forall>t. ret__unsigned_long_' t = args ! 1 \<longrightarrow> \<not> (args ! 1 = 0 \<or> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat (args ! 1)) \<longrightarrow> (\<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr rv \<or> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> tcb_ptr_to_ctcb_ptr rv = tcb_ptr_to_ctcb_ptr thread \<and> (\<forall>t. s\<lparr>flags_' := args ! 0, n_' := args ! 1, transferArch_' := 0, ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), thread_' := tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)), globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 && 2 ^ unat ReadRegisters_suspend = from_bool (args ! 0 !! 0) \<and> ReadRegisters_suspend <s 0x20 \<and> 0 \<le>s ReadRegisters_suspend \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) \<noteq> tcb_ptr_to_ctcb_ptr rv) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)}}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0\<rbrakk> \<Longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb xc. xa = xb # xc \<longrightarrow> sysargs_rel (x # xb # xc) buffer s \<and> sysargs_rel_n (x # xb # xc) buffer 0 s \<and> sysargs_rel (x # xb # xc) buffer s \<and> sysargs_rel_n (x # xb # xc) buffer (Suc 0) s \<and> (1 \<le> xb \<and> xb \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters) \<longrightarrow> v0 \<noteq> ksCurThread s \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> v0 \<noteq> ksIdleThread s) \<and> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = xb) \<longrightarrow> xb \<noteq> 0 \<and> \<not> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat xb \<longrightarrow> v0 = ksCurThread s \<or> x && 1 = from_bool (x !! 0) \<and> v0 \<noteq> ksCurThread s)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb xc. xa = xb # xc \<longrightarrow> sysargs_rel (x # xb # xc) buffer s \<and> sysargs_rel_n (x # xb # xc) buffer 0 s \<and> sysargs_rel (x # xb # xc) buffer s \<and> sysargs_rel_n (x # xb # xc) buffer (Suc 0) s \<and> (1 \<le> xb \<and> xb \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters) \<longrightarrow> v0 \<noteq> ksCurThread s \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> v0 \<noteq> ksIdleThread s) \<and> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = xb) \<longrightarrow> xb \<noteq> 0 \<and> \<not> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat xb \<longrightarrow> v0 = ksCurThread s \<or> x && 1 = from_bool (x !! 0) \<and> v0 \<noteq> ksCurThread s)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb xc. xa = xb # xc \<longrightarrow> sysargs_rel (x # xb # xc) buffer s \<and> sysargs_rel_n (x # xb # xc) buffer 0 s \<and> sysargs_rel (x # xb # xc) buffer s \<and> sysargs_rel_n (x # xb # xc) buffer (Suc 0) s \<and> (1 \<le> xb \<and> xb \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters) \<longrightarrow> v0 \<noteq> ksCurThread s \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> v0 \<noteq> ksIdleThread s) \<and> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647)
 2. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = xb) \<longrightarrow> xb \<noteq> 0 \<and> \<not> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat xb \<longrightarrow> v0 = ksCurThread s \<or> x && 1 = from_bool (x !! 0) \<and> v0 \<noteq> ksCurThread s) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xb xc. \<lbrakk>unat length___unsigned_long = Suc (Suc (length xc)); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel (x # xb # xc) buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s; args = x # xb # xc\<rbrakk> \<Longrightarrow> sysargs_rel_n (x # xb # xc) buffer 0 s \<and> sysargs_rel_n (x # xb # xc) buffer (Suc 0) s \<and> (1 \<le> xb \<and> xb \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters) \<longrightarrow> v0 \<noteq> ksCurThread s \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> v0 \<noteq> ksIdleThread s) \<and> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647
 2. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = xb) \<longrightarrow> xb \<noteq> 0 \<and> \<not> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat xb \<longrightarrow> v0 = ksCurThread s \<or> x && 1 = from_bool (x !! 0) \<and> v0 \<noteq> ksCurThread s) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xb xc. \<lbrakk>unat length___unsigned_long = Suc (Suc (length xc)); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel (x # xb # xc) buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s; args = x # xb # xc\<rbrakk> \<Longrightarrow> sysargs_rel_n (x # xb # xc) buffer (Suc 0) s \<and> (1 \<le> xb \<and> xb \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters) \<longrightarrow> v0 \<noteq> ksCurThread s \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> v0 \<noteq> ksIdleThread s) \<and> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647
 2. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = xb) \<longrightarrow> xb \<noteq> 0 \<and> \<not> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat xb \<longrightarrow> v0 = ksCurThread s \<or> x && 1 = from_bool (x !! 0) \<and> v0 \<noteq> ksCurThread s) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xb xc. \<lbrakk>unat length___unsigned_long = Suc (Suc (length xc)); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel (x # xb # xc) buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s; args = x # xb # xc\<rbrakk> \<Longrightarrow> (1 \<le> xb \<and> xb \<le> word_of_nat (length TCB_H.frameRegisters) + word_of_nat (length TCB_H.gpRegisters) \<longrightarrow> v0 \<noteq> ksCurThread s \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> v0 \<noteq> ksIdleThread s) \<and> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647
 2. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = xb) \<longrightarrow> xb \<noteq> 0 \<and> \<not> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat xb \<longrightarrow> v0 = ksCurThread s \<or> x && 1 = from_bool (x !! 0) \<and> v0 \<noteq> ksCurThread s) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' v0. \<lbrakk>unat length___unsigned_long = length args; ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; sysargs_rel args buffer s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; cp = capability.ThreadCap v0; \<not> ex_nonz_cap_to' (ksIdleThread s) s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>xb. (\<exists>x. xa = xb # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = xb) \<longrightarrow> xb \<noteq> 0 \<and> \<not> unat (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) < unat xb \<longrightarrow> v0 = ksCurThread s \<or> x && 1 = from_bool (x !! 0) \<and> v0 \<noteq> ksCurThread s) proof (prove)
goal:
No subgoals!