theory Tcb_C

lemma invokeTCB_CopyRegisters_ccorres:
  "ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_')
   (invs' and sch_act_simple and tcb_at' destn and tcb_at' source
          and ex_nonz_cap_to' destn and ex_nonz_cap_to' source)
   (UNIV \<inter> {s. dest_' s = tcb_ptr_to_ctcb_ptr destn}
         \<inter> {s. tcb_src_' s = tcb_ptr_to_ctcb_ptr source}
         \<inter> {s. to_bool (resumeTarget_' s) = resume}
         \<inter> {s. to_bool (suspendSource_' s) = susp}
         \<inter> {s. to_bool (transferFrame_' s) = frames}
         \<inter> {s. to_bool (transferInteger_' s) = ints}) []
   (invokeTCB (CopyRegisters destn source susp resume frames ints arch))
   (Call invokeTCB_CopyRegisters_'proc)" apply (cinit lift: dest_' tcb_src_' resumeTarget_'
                     suspendSource_' transferFrame_' transferInteger_'
               simp: whileAnno_def) apply (simp add: liftE_def bind_assoc whileAnno_def
               del: Collect_const) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_when[where R=\<top>]) apply (simp add: to_bool_def del: Collect_const) apply (ctac add: suspend_ccorres[OF cteDeleteOne_ccorres]) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_when[where R=\<top>]) apply (simp add: to_bool_def del: Collect_const) apply (ctac add: restart_ccorres) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_when[where R=\<top>]) apply (simp add: to_bool_def Collect_const_mem) apply (rule ccorres_rhs_assoc)+ apply (csymbr, csymbr, csymbr) apply (rule ccorres_rhs_assoc2, rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_rel_imp) apply (rule ccorres_mapM_x_while[where F="\<lambda>x. tcb_at' destn and tcb_at' source"]) apply clarsimp apply (rule ccorres_guard_imp2) apply (ctac(no_vcg) add: getRegister_ccorres) apply (ctac add: setRegister_ccorres) apply wp apply (clarsimp simp: frame_gp_registers_convs
                                        n_frameRegisters_def unat_of_nat32
                                        word_bits_def word_of_nat_less) apply (simp add: frame_gp_registers_convs n_frameRegisters_def) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (wp | simp)+ apply (simp add: frame_gp_registers_convs n_frameRegisters_def
                               word_bits_def) apply simp apply (ctac(no_vcg) add: getRestartPC_ccorres) apply (ctac add: setNextPC_ccorres) apply wp+ apply (clarsimp simp: guard_is_UNIV_def) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_when[where R=\<top>]) apply (simp add: to_bool_def Collect_const_mem) apply (rule ccorres_rhs_assoc)+ apply (csymbr, csymbr) apply (rule ccorres_rel_imp) apply (rule ccorres_mapM_x_while[where F="\<lambda>x. tcb_at' destn and tcb_at' source"]) apply clarsimp apply (rule ccorres_guard_imp2) apply ((wp | ctac(no_vcg) add: getRegister_ccorres setRegister_ccorres)+)[1] apply (clarsimp simp: frame_gp_registers_convs n_gpRegisters_def
                                       unat_of_nat32 word_bits_def word_of_nat_less) apply (simp add: frame_gp_registers_convs n_gpRegisters_def) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (wp | simp)+ apply (simp add: word_bits_def frame_gp_registers_convs n_gpRegisters_def) apply simp apply (rule ccorres_pre_getCurThread) apply (rename_tac thread) apply (ctac add: postModifyRegisters_ccorres[simplified]) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule_tac R="\<lambda>s. thread = ksCurThread s" in ccorres_when) apply (clarsimp simp: rf_sr_ksCurThread) apply clarsimp apply (ctac (no_vcg) add: rescheduleRequired_ccorres) apply (simp only: liftE_bindE[symmetric] return_returnOk) apply (ctac(no_vcg) add: Arch_performTransfer_ccorres) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply simp apply wp+ apply (clarsimp simp: guard_is_UNIV_def) apply simp apply (wpsimp simp: postModifyRegisters_def pred_conj_def
                          cong: if_cong
                            wp: hoare_drop_imps) apply vcg apply (wp hoare_drop_imp) apply (simp add: pred_conj_def guard_is_UNIV_def  cong: if_cong
                      | wp mapM_x_wp_inv hoare_drop_imp)+ apply clarsimp apply (rule_tac Q="\<lambda>rv. invs' and tcb_at' destn" in hoare_strengthen_post[rotated]) apply (fastforce simp: sch_act_wf_weak) apply (wpsimp wp: hoare_drop_imp restart_invs')+ apply (clarsimp simp add: guard_is_UNIV_def) apply (wp hoare_drop_imp hoare_vcg_if_lift)+ apply simp apply (rule_tac Q="\<lambda>rv. invs' and tcb_at' destn" in hoare_strengthen_post[rotated]) apply (fastforce simp: sch_act_wf_weak) apply (wpsimp wp: hoare_drop_imp)+ apply (clarsimp simp add: guard_is_UNIV_def) apply (clarsimp simp: invs_weak_sch_act_wf invs_valid_objs'
                 split: if_split
            | rule conjI)+ apply (clarsimp dest!: global'_no_ex_cap simp: invs'_def valid_state'_def | rule conjI)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) (UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr destn\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr source\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = resume\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = susp\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = frames\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = ints\<rbrace>) [] (invokeTCB (tcbinvocation.CopyRegisters destn source susp resume frames ints arch)) (Call invokeTCB_CopyRegisters_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3187 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) (?Q'3187 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) [SKIP] (liftE (do y <- when susp (ThreadDecls_H.suspend source);
y <- when resume (ThreadDecls_H.restart destn);
y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return []
od)) (IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI;;
(IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(dest)
FI;;
(IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(dest);;
CALL setNextPC_'proc(dest,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(dest);;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_src,dest);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3187 transferInteger transferFrame suspendSource resumeTarget tcb_src dest s \<and> s' \<in> ?Q'3187 transferInteger transferFrame suspendSource resumeTarget tcb_src dest proof (prove)
goal (2 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3187 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) (?Q'3187 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) [SKIP] (do y <- when susp (ThreadDecls_H.suspend source);
y <- when resume (ThreadDecls_H.restart destn);
y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_ptr_to_ctcb_ptr source)
FI;;
(IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn)
FI;;
(IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3187 transferInteger transferFrame suspendSource resumeTarget tcb_src dest s \<and> s' \<in> ?Q'3187 transferInteger transferFrame suspendSource resumeTarget tcb_src dest proof (prove)
goal (5 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3207 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) (?Q'3187 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) [] (when susp (ThreadDecls_H.suspend source)) (IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_ptr_to_ctcb_ptr source)
FI)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y) (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') [SKIP] (do y <- when resume (ThreadDecls_H.restart destn);
y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn)
FI;;
(IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3207 transferInteger transferFrame suspendSource resumeTarget tcb_src dest and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> ?Q'3187 transferInteger transferFrame suspendSource resumeTarget tcb_src dest proof (prove)
goal (6 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> susp = (s' \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace>)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3218 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) (?Rt3216 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) [] (ThreadDecls_H.suspend source) (CALL suspend_'proc(tcb_ptr_to_ctcb_ptr source))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y) (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') [SKIP] (do y <- when resume (ThreadDecls_H.restart destn);
y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn)
FI;;
(IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> ?Pt3218 transferInteger transferFrame suspendSource resumeTarget tcb_src dest s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3216 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (5 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3218 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) (?Rt3216 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)) [] (ThreadDecls_H.suspend source) (CALL suspend_'proc(tcb_ptr_to_ctcb_ptr source))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y) (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') [SKIP] (do y <- when resume (ThreadDecls_H.restart destn);
y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn)
FI;;
(IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> ?Pt3218 transferInteger transferFrame suspendSource resumeTarget tcb_src dest s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3216 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (4 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y) (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') [SKIP] (do y <- when resume (ThreadDecls_H.restart destn);
y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn)
FI;;
(IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>?Q3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (7 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3236 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y) (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') [] (when resume (ThreadDecls_H.restart destn)) (IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn)
FI)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [SKIP] (do y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv')
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. ?P3236 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3194 transferInteger transferFrame suspendSource resumeTarget tcb_src dest)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (8 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> resume = (s' \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace>)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3244 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y) (?Rt3242 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') [] (ThreadDecls_H.restart destn) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [SKIP] (do y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv')
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> ?Pt3244 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3242 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (7 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3244 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y) (?Rt3242 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') [] (ThreadDecls_H.restart destn) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr destn))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [SKIP] (do y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv')
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> ?Pt3244 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3242 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv') \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (6 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [SKIP] (do y <- when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od);
y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI;;
(IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>?Q3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv')
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (9 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3258 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [] (when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od)) (IF transferFrame \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)
FI)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. ?P3258 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3235 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv')
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (10 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> frames = (s' \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace>)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Rt3264 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [] (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> ?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3264 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (9 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Rt3264 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [] (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
lvar_nondet_init pc_' pc_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> ?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3264 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (9 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?Rt3264 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [] (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (lvar_nondet_init i_' i_'_update;;
(lvar_nondet_init v_' v_'_update;;
(lvar_nondet_init pc_' pc_'_update;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc)))))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> ?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3264 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (9 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?G'3304 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [] (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> ?Pt3266 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> ?G'3304 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3316 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?G'3304 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [] (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (?P3316 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> ?G'3304 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (?r'3322 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) (?xf'3322 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) (?P3316 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) (?G'3304 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a) [] (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; ?r'3322 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x (?xf'3322 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (?P3316 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> ?G'3304 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 13 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>n<length TCB_H.frameRegisters. ccorres dc xfdc (tcb_at' destn and tcb_at' source) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (n < word_of_nat (length TCB_H.frameRegisters))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' destn and tcb_at' source) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (n < word_of_nat (length TCB_H.frameRegisters))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3351 transferInteger transferFrame suspendSource resumeTarget n) (?Q'3351 transferInteger transferFrame suspendSource resumeTarget n) [] (do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget n s s'. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters; (s, s') \<in> rf_sr; (tcb_at' destn and tcb_at' source) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3351 transferInteger transferFrame suspendSource resumeTarget n s \<and> s' \<in> ?Q'3351 transferInteger transferFrame suspendSource resumeTarget n
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (n < word_of_nat (length TCB_H.frameRegisters))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n rv v. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters; rv = v\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3357 transferInteger transferFrame suspendSource resumeTarget n rv) (?Q'3357 transferInteger transferFrame suspendSource resumeTarget n rv v) [] (asUser destn (setRegister (TCB_H.frameRegisters ! n) rv)) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],v)))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget n. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R3357 transferInteger transferFrame suspendSource resumeTarget n\<rbrace> asUser source (getRegister (TCB_H.frameRegisters ! n)) \<lbrace>?Q3357 transferInteger transferFrame suspendSource resumeTarget n\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget n s s'. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters; (s, s') \<in> rf_sr; (tcb_at' destn and tcb_at' source) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R3357 transferInteger transferFrame suspendSource resumeTarget n) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr source) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr source\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.frameRegisters ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> v_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'3357 transferInteger transferFrame suspendSource resumeTarget n rv (ret__unsigned_long_' t)} \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (n < word_of_nat (length TCB_H.frameRegisters))
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R3357 transferInteger transferFrame suspendSource resumeTarget n\<rbrace> asUser source (getRegister (TCB_H.frameRegisters ! n)) \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget n s s'. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters; (s, s') \<in> rf_sr; (tcb_at' destn and tcb_at' source) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R3357 transferInteger transferFrame suspendSource resumeTarget n) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr source) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr source\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.frameRegisters ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> v_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. w_'_update (\<lambda>_. ret__unsigned_long_' t) (reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.frameRegisters ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = rv\<rbrace>} \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>} \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (n < word_of_nat (length TCB_H.frameRegisters))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n s s'. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.frameRegisters; (s, s') \<in> rf_sr; (tcb_at' destn and tcb_at' source) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True)) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr source) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr source\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.frameRegisters ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> v_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. w_'_update (\<lambda>_. ret__unsigned_long_' t) (reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.frameRegisters ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = rv\<rbrace>} \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>} \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (n < word_of_nat (length TCB_H.frameRegisters))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (n < word_of_nat (length TCB_H.frameRegisters))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a s. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. i_' sa < 0xA \<longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (i_' sa)] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr source \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr destn \<longrightarrow> i_' sa = i_' s}
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; Suc n < length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.frameRegisters ! n));
asUser destn (setRegister (TCB_H.frameRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> length TCB_H.frameRegisters < 2 ^ word_bits
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; i_' ya = word_of_nat (length TCB_H.frameRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya) (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b) [] (do pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr destn);;
CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,\<acute>pc))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>?Q3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3315 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b rva pc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b; rva = pc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3487 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b rva) (?Q'3487 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b rva pc) [] (asUser destn (setNextPC rva)) (CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr destn,pc))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3489 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya\<rbrace> asUser destn getRestartPC \<lbrace>?Q3487 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?R3489 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>ya rv'b. {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace>} \<inter> {s'. \<forall>t rva. rva = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'3487 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b rva (ret__unsigned_long_' t)})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc ya rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3489 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya\<rbrace> asUser destn getRestartPC \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?R3489 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a ya\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>ya rv'b. {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace> \<inter> \<lbrace>\<acute>v = rv\<rbrace>}})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and ?R3317 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>ya rv'b. {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace> \<inter> \<lbrace>\<acute>v = rv\<rbrace>}})
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (8 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [SKIP] (do y <- when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters);
thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI;;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>?Q3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3552 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [] (when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters)) (IF transferInteger \<noteq> 0 THEN
  lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. ?P3552 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3257 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> ints = (s' \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace>)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Rt3558 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [] (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) (lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> ?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3558 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Rt3558 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [] (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) (lvar_nondet_init i_' i_'_update;;
lvar_nondet_init v_' v_'_update;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> ?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3558 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?Rt3558 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [] (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) (lvar_nondet_init i_' i_'_update;;
(lvar_nondet_init v_' v_'_update;;
(\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1))))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> ?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt3558 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?G'3581 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [] (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> ?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> ?G'3581 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> ccorres (?r'3590 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) (?xf'3590 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) (?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva) (?G'3581 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b) [] (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v));;
\<acute>i :== \<acute>i + 1))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; ?r'3590 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x (?xf'3590 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b ya)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> ?Pt3560 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> ?G'3581 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>n<length TCB_H.gpRegisters. ccorres dc xfdc (tcb_at' destn and tcb_at' source) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od) (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (n < word_of_nat (length TCB_H.gpRegisters))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (tcb_at' destn and tcb_at' source) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od) (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (n < word_of_nat (length TCB_H.gpRegisters))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3619 transferInteger transferFrame suspendSource resumeTarget n) (?Q'3619 transferInteger transferFrame suspendSource resumeTarget n) [] (do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od) (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget n s s'. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.gpRegisters; (s, s') \<in> rf_sr; (tcb_at' destn and tcb_at' source) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3619 transferInteger transferFrame suspendSource resumeTarget n s \<and> s' \<in> ?Q'3619 transferInteger transferFrame suspendSource resumeTarget n
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (n < word_of_nat (length TCB_H.gpRegisters))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget n s s'. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; n < length TCB_H.gpRegisters; (s, s') \<in> rf_sr; (tcb_at' destn and tcb_at' source) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True)) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.gpRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr source) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr source\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.gpRegisters ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> v_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. w_'_update (\<lambda>_. ret__unsigned_long_' t) (reg_'_update (\<lambda>_. kernel_all_global_addresses.gpRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr destn\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.gpRegisters ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = rv\<rbrace>} \<inter> \<lbrace>\<acute>i < 9\<rbrace>} \<inter> \<lbrace>\<acute>i < 9\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (n < word_of_nat (length TCB_H.gpRegisters))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> (n < SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (n < word_of_nat (length TCB_H.gpRegisters))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr source,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr destn,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>v)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b s. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. i_' sa < 9 \<longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (i_' sa)] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr source \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr destn \<longrightarrow> i_' sa = i_' s}
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b n. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; Suc n < length TCB_H.gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' destn and tcb_at' source\<rbrace> do v <- asUser source (getRegister (TCB_H.gpRegisters ! n));
asUser destn (setRegister (TCB_H.gpRegisters ! n) v)
od \<lbrace>\<lambda>_. tcb_at' destn and tcb_at' source\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> length TCB_H.gpRegisters < 2 ^ word_bits
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b x ya. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; i_' ya = word_of_nat (length TCB_H.gpRegisters)\<rbrakk> \<Longrightarrow> dc x (xfdc ya)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb) (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c) [SKIP] (do thread <- getCurThread;
y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>?Q3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3551 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (10 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3754 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) (?P'3753 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc) [SKIP] (do y <- asUser destn (postModifyRegisters rvc destn);
y <- when (destn = rvc) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ?P3754 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc s\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> ?P'3753 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (10 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3754 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread) (?P'3753 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) [SKIP] (do y <- asUser destn (postModifyRegisters thread destn);
y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn);;
(IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ?P3754 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc s\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> ?P'3753 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc) (?Q'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc) [SKIP] (do y <- when (destn = thread) rescheduleRequired;
y <- performTransfer arch source destn;
return (Inr [])
od) (IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
(\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>?Q3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> ?Q'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc (xfdc s)}
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3800 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc) (?Q'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca) [] (when (destn = thread) rescheduleRequired) (IF tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya) (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd) [SKIP] (do y <- performTransfer arch source destn;
return (Inr [])
od) (\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. ?P3800 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> ?Q'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc (xfdc s)}
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> thread = ksCurThread s \<longrightarrow> (destn = thread) = (s' \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace>)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3809 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc) (?Rt3806 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca) [] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya) (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd) [SKIP] (do y <- performTransfer arch source destn;
return (Inr [])
od) (\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca)
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> ?Pt3809 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?Rt3806 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc (xfdc s)) \<and> (sa \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> UNIV)}}
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3809 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc) (?Rt3806 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca) [] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya) (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd) [SKIP] (do y <- performTransfer arch source destn;
return (Inr [])
od) (\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> ?Pt3809 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?Rt3806 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc (xfdc s)) \<and> (sa \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> UNIV)}}
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget rv' rv'a rv'b rv'c thread xfdca. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3809 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) () rv' () rv'a () rv'b () rv'c thread ()) (?Rt3806 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) () rv' () rv'a () rv'b () rv'c thread () xfdca) [] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya) (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd) [SKIP] (do y <- performTransfer arch source destn;
return (Inr [])
od) (\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca)
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> ?Pt3809 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. (sa \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> ?Rt3806 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc (xfdc s)) \<and> (sa \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> sa \<in> UNIV)}}
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya) (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd) [SKIP] (do y <- performTransfer arch source destn;
return (Inr [])
od) (\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3799 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya) (?Q'3799 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd) [SKIP] (doE y <- liftE (performTransfer arch source destn);
returnOk []
odE) (\<acute>ret__unsigned_long :== CALL Arch_performTransfer_'proc(\<acute>transferArch,tcb_ptr_to_ctcb_ptr source,tcb_ptr_to_ctcb_ptr destn);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>?Q3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3799 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca)
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd rvd ret__unsigned_long. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd; dc rvd (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. a = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3871 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd rvd) (?Q'3891 transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd rvd ret__unsigned_long) [SKIP] (returnOk []) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err rv'e ret__unsigned_long. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd; id rv'e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'e) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. a = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE3871 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err) (?Q''3889 transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err rv'e ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'e))
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?R3883 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya\<rbrace> liftE (performTransfer arch source destn) \<lbrace>?Q3871 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd\<rbrace>, \<lbrace>?QE3871 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3883 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc a\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. transferArch_' s) s)) \<in> UNIV} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. dc rvd (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'3890 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca a b t rvd)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''3888 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca a b t err))})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
A total of 16 subgoals...
flex-flex pairs:
\<lambda>transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd t rvd. ?Q'3891 transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd rvd (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>transferInteger transferFrame suspendSource resumeTarget. ?Q'3890 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)
\<lambda>transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd t err. ?Q''3889 transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>transferInteger transferFrame suspendSource resumeTarget. ?Q''3888 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) proof (prove)
goal (15 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err rv'e ret__unsigned_long. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd; id rv'e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'e) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>a b. a = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE3871 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err) (?Q''3889 transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err rv'e ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'e))
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?R3883 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya\<rbrace> liftE (performTransfer arch source destn) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE3871 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3883 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc a\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. transferArch_' s) s)) \<in> UNIV} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> [] = []\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''3888 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca a b t err))})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 15 subgoals...
flex-flex pairs:
\<lambda>transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd t err. ?Q''3889 transferInteger transferFrame suspendSource resumeTarget y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>transferInteger transferFrame suspendSource resumeTarget. ?Q''3888 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) proof (prove)
goal (14 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya rv'd. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc; dc ya rv'd\<rbrakk> \<Longrightarrow> \<lbrace>?R3883 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc ya\<rbrace> liftE (performTransfer arch source destn) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3883 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc a\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. transferArch_' s) s)) \<in> UNIV} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> [] = []\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)}))})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest rv' rv'a rv'b rv'c thread xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3883 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) () rv' () rv'a () rv'b () rv'c thread () xfdc ()\<rbrace> performTransfer arch source destn \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace> when (destn = thread) rescheduleRequired \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3883 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdc a\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. transferArch_' s) s)) \<in> UNIV} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> [] = []\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)}))})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and ?R3801 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread rvc xfdca. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c; dc rvc xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. transferArch_' s) s)) \<in> UNIV} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> [] = []\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)}))})
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and (\<lambda>s. True \<and> True)\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. destn \<noteq> thread \<longrightarrow> True) and (\<lambda>s. True \<and> True)\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest rv' rv'a rv'b thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3760 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) () rv' () rv'a () rv'b () thread\<rbrace> asUser destn (postModifyRegisters thread destn) \<lbrace>\<lambda>rvc. (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. destn = thread \<longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rvc. ksCurThread s = rvc \<longrightarrow> ((\<lambda>_. True) and ?R3760 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rvc) s\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; dc rvb rv'c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c thread) CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr destn) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr destn = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. rv = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) s\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rvc. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rvc \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> ?R'3758 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b rvb rv'c rvc})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 10. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (9 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> when ints (mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters) \<lbrace>\<lambda>rvb s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. rv = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) s\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> (tcb_ptr_to_ctcb_ptr destn = ksCurThread_' (globals s) \<longrightarrow> True) \<and> (tcb_ptr_to_ctcb_ptr destn \<noteq> ksCurThread_' (globals s) \<longrightarrow> True)}})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and ?R3553 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (9 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b; ints\<rbrakk> \<Longrightarrow> \<lbrace>?Q4023 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva\<rbrace> mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.gpRegisters \<lbrace>\<lambda>rvb s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. rv = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) s\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva rv'b. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a; dc rva rv'b\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvb rv'c. {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV} \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> (tcb_ptr_to_ctcb_ptr destn = ksCurThread_' (globals s) \<longrightarrow> True) \<and> (tcb_ptr_to_ctcb_ptr destn \<noteq> ksCurThread_' (globals s) \<longrightarrow> True)}})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace> when frames (do y <- mapM_x (\<lambda>r. do v <- asUser source (getRegister r);
asUser destn (setRegister r v)
od) TCB_H.frameRegisters;
pc <- asUser destn getRestartPC;
asUser destn (setNextPC pc)
od) \<lbrace>\<lambda>rva. (\<lambda>_. True) and (\<lambda>s. ints \<longrightarrow> (tcb_at' destn and tcb_at' source) s) and (\<lambda>s. \<not> ints \<longrightarrow> True) and (if ints then ?Q4023 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a rva else (\<lambda>s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. rv = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) s))\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv rv'a. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'; dc rv rv'a\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'b. {s. (s \<in> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> UNIV}}) \<and> (s \<notin> \<lbrace>transferInteger \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace> when resume (ThreadDecls_H.restart destn) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. frames \<longrightarrow> (tcb_at' destn and tcb_at' source and (\<lambda>s. True \<and> True)) s) and (\<lambda>s. \<not> frames \<longrightarrow> True) and ?R3259 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv' rv\<rbrace>
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R3237 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y\<rbrace>
 8. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 9. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (5 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; resume\<rbrakk> \<Longrightarrow> \<lbrace>?P'4162 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) ()\<rbrace> ThreadDecls_H.restart destn \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (\<lambda>a. (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4162 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (5 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget. \<lbrakk>to_bool resumeTarget; resume; ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource\<rbrakk> \<Longrightarrow> \<lbrace>?P'4162 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) ()\<rbrace> ThreadDecls_H.restart destn \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (\<lambda>a. (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4162 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (6 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget rv s. \<lbrakk>to_bool resumeTarget; resume; ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; (invs' and tcb_at' destn) s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s
 2. \<And>transferInteger transferFrame suspendSource resumeTarget. \<lbrakk>to_bool resumeTarget; resume; ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource\<rbrakk> \<Longrightarrow> \<lbrace>?P'4162 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) ()\<rbrace> ThreadDecls_H.restart destn \<lbrace>\<lambda>rv. invs' and tcb_at' destn\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (\<lambda>a. (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4162 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)\<rbrace>
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (5 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget. \<lbrakk>to_bool resumeTarget; resume; ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource\<rbrakk> \<Longrightarrow> \<lbrace>?P'4162 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn) ()\<rbrace> ThreadDecls_H.restart destn \<lbrace>\<lambda>rv. invs' and tcb_at' destn\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest y rv'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. (s \<in> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. v_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> UNIV}}}) \<and> (s \<notin> \<lbrace>transferFrame \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (\<lambda>a. (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4162 transferInteger transferFrame suspendSource resumeTarget tcb_src dest y a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)\<rbrace>
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (4 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. UNIV)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (\<lambda>a. (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (3 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> \<lbrace>?R3205 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> when susp (ThreadDecls_H.suspend source) \<lbrace>\<lambda>y. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' destn and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (\<lambda>a. (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if resume then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R3205 transferInteger transferFrame suspendSource resumeTarget tcb_src dest) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (3 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; susp\<rbrakk> \<Longrightarrow> \<lbrace>?P'4405 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> ThreadDecls_H.suspend source \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (\<lambda>a. True \<and> (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a \<and> sch_act_simple a else (\<lambda>s. invs' s \<and> tcb_at' destn s \<and> sch_act_simple s)) a \<and> True \<and> ((if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a) \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> ex_nonz_cap_to' destn a \<and> destn \<noteq> ksIdleThread a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) s \<and> tcb_at' destn s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4405 transferInteger transferFrame suspendSource resumeTarget tcb_src dest a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (3 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; susp\<rbrakk> \<Longrightarrow> \<lbrace>?P'4405 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> ThreadDecls_H.suspend source \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (\<lambda>a. True \<and> (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a \<and> sch_act_simple a else (\<lambda>s. invs' s \<and> tcb_at' destn s \<and> sch_act_simple s)) a \<and> True \<and> ((if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a) \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> ex_nonz_cap_to' destn a \<and> destn \<noteq> ksIdleThread a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) s \<and> tcb_at' destn s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4405 transferInteger transferFrame suspendSource resumeTarget tcb_src dest a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (4 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest rv s. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; susp; (invs' and tcb_at' destn) s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; susp\<rbrakk> \<Longrightarrow> \<lbrace>?P'4405 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> ThreadDecls_H.suspend source \<lbrace>\<lambda>rv. invs' and tcb_at' destn\<rbrace>
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (\<lambda>a. True \<and> (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a \<and> sch_act_simple a else (\<lambda>s. invs' s \<and> tcb_at' destn s \<and> sch_act_simple s)) a \<and> True \<and> ((if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a) \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> ex_nonz_cap_to' destn a \<and> destn \<noteq> ksIdleThread a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) s \<and> tcb_at' destn s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4405 transferInteger transferFrame suspendSource resumeTarget tcb_src dest a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (3 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; susp\<rbrakk> \<Longrightarrow> \<lbrace>?P'4405 transferInteger transferFrame suspendSource resumeTarget (tcb_ptr_to_ctcb_ptr source) (tcb_ptr_to_ctcb_ptr destn)\<rbrace> ThreadDecls_H.suspend source \<lbrace>\<lambda>rv. invs' and tcb_at' destn\<rbrace>
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. (s \<in> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr destn) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr destn\<rbrace>}) \<and> (s \<notin> \<lbrace>resumeTarget \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (\<lambda>a. True \<and> (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a \<and> sch_act_simple a else (\<lambda>s. invs' s \<and> tcb_at' destn s \<and> sch_act_simple s)) a \<and> True \<and> ((if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a) \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> ex_nonz_cap_to' destn a \<and> destn \<noteq> ksIdleThread a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) s \<and> tcb_at' destn s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> ?P'4405 transferInteger transferFrame suspendSource resumeTarget tcb_src dest a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (2 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget. \<lbrakk>ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. UNIV)
 2. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (\<lambda>a. True \<and> (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a \<and> sch_act_simple a else (\<lambda>s. invs' s \<and> tcb_at' destn s \<and> sch_act_simple s)) a \<and> True \<and> ((if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a) \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> ex_nonz_cap_to' destn a \<and> destn \<noteq> ksIdleThread a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) s \<and> tcb_at' destn s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (1 subgoal):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget tcb_src dest s s'. \<lbrakk>to_bool transferInteger = ints; to_bool transferFrame = frames; to_bool suspendSource = susp; to_bool resumeTarget = resume; tcb_src = tcb_ptr_to_ctcb_ptr source; dest = tcb_ptr_to_ctcb_ptr destn; (s, s') \<in> rf_sr; (invs' and sch_act_simple and tcb_at' destn and tcb_at' source and ex_nonz_cap_to' destn and ex_nonz_cap_to' source) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (\<lambda>a. True \<and> (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a \<and> sch_act_simple a else (\<lambda>s. invs' s \<and> tcb_at' destn s \<and> sch_act_simple s)) a \<and> True \<and> ((if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s)) a) \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> ex_nonz_cap_to' destn a \<and> destn \<noteq> ksIdleThread a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> (invs' and ex_nonz_cap_to' destn and (\<lambda>s. destn \<noteq> ksIdleThread s)) s \<and> tcb_at' destn s)) a \<and> (if susp then \<lambda>a. tcb_at' destn a \<and> tcb_at' source a \<and> (invs' and sch_act_simple and tcb_at' source and (\<lambda>s. source \<noteq> ksIdleThread s)) a \<and> tcb_at' destn a else (\<lambda>s. tcb_at' destn s \<and> tcb_at' source s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) a)) s \<and> s' \<in> {s. (s \<in> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>suspendSource \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (3 subgoals):
 1. \<And>transferInteger transferFrame suspendSource resumeTarget s s'. \<lbrakk>(s, s') \<in> rf_sr; ints = to_bool transferInteger; frames = to_bool transferFrame; resume = to_bool resumeTarget; invs' s; sch_act_simple s; tcb_at' destn s; tcb_at' (ksIdleThread s) s; ex_nonz_cap_to' destn s; ex_nonz_cap_to' (ksIdleThread s) s; susp; to_bool suspendSource; source = ksIdleThread s\<rbrakk> \<Longrightarrow> False
 2. \<And>transferInteger transferFrame suspendSource resumeTarget s s'. \<lbrakk>(s, s') \<in> rf_sr; ints = to_bool transferInteger; frames = to_bool transferFrame; resume = to_bool resumeTarget; invs' s; sch_act_simple s; tcb_at' destn s; tcb_at' source s; ex_nonz_cap_to' destn s; ex_nonz_cap_to' source s; susp; to_bool suspendSource\<rbrakk> \<Longrightarrow> destn \<noteq> ksIdleThread s \<and> source \<noteq> ksIdleThread s
 3. \<And>transferInteger transferFrame suspendSource resumeTarget s s'. \<lbrakk>(s, s') \<in> rf_sr; ints = to_bool transferInteger; frames = to_bool transferFrame; susp = to_bool suspendSource; resume = to_bool resumeTarget; invs' s; sch_act_simple s; tcb_at' destn s; tcb_at' source s; ex_nonz_cap_to' destn s; ex_nonz_cap_to' source s\<rbrakk> \<Longrightarrow> \<not> to_bool suspendSource \<longrightarrow> destn \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s proof (prove)
goal:
No subgoals!