theory Tcb_C

lemma invokeTCB_WriteRegisters_ccorres[where S=UNIV]:
  notes hoare_weak_lift_imp [wp]
  shows
  "ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_')
   (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple
          and sysargs_rel args buffer
          and (\<lambda>s. dst \<noteq> ksCurThread s)
          and (\<lambda>_. values = take someNum (drop 2 args)
                   \<and> someNum + 2 \<le> length args))
   ({s. unat (n_' s) = length values} \<inter> S
         \<inter> {s. unat (n_' s) = length values}
         \<inter> {s. dest_' s = tcb_ptr_to_ctcb_ptr dst}
         \<inter> {s. resumeTarget_' s = from_bool resume}
         \<inter> {s. buffer_' s = option_to_ptr buffer}) []
   (invokeTCB (WriteRegisters dst resume values arch))
   (Call invokeTCB_WriteRegisters_'proc)" supply empty_fail_cond[simp] apply (rule ccorres_gen_asm) apply (erule conjE) apply (cinit lift: n_' dest_' resumeTarget_' buffer_'
               simp: whileAnno_def) 
   (* using S not univ seems to stop cinit doing this? *)
    apply (csymbr, csymbr, csymbr, csymbr) apply (simp add: liftE_def bind_assoc
               del: Collect_const) apply (rule ccorres_pre_getCurThread) apply (rule_tac P="\<lambda>a. ccorres_underlying rf_sr \<Gamma> r' xf arrel axf P P' hs a c" for r' xf arrel axf P P' hs c in subst) apply (rule liftE_bindE) apply (ctac add: Arch_performTransfer_ccorres) apply (simp add: Collect_False whileAnno_def del: Collect_const) apply (rule ccorres_add_return) apply (rule_tac xf'=n_' and r'="\<lambda>rv rv'. rv' = min n (scast n_frameRegisters + scast n_gpRegisters)"
                    in ccorres_split_nothrow) apply (rule_tac P'="{s. n_' s = n}" in ccorres_from_vcg[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def min_def) apply (simp add: linorder_not_less[symmetric] n_gpRegisters_def n_frameRegisters_def) apply ceqv apply (ctac add: Arch_getSanitiseRegisterInfo_ccorres) apply (simp add: zipWithM_mapM split_def zip_append1 mapM_discarded mapM_x_append
                       del: Collect_const) apply (simp add: asUser_bind_distrib getRestartPC_def setNextPC_def bind_assoc
                       del: Collect_const) apply (simp only: getRestartPC_def[symmetric] setNextPC_def[symmetric]) apply (simp add: asUser_mapM_x bind_assoc) apply (rule ccorres_stateAssert) apply (rule ccorres_rhs_assoc2, rule ccorres_split_nothrow_novcg) apply (rule_tac F="\<lambda>n. sysargs_rel args buffer and sysargs_rel_n args buffer (n + 2)
                                     and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)"
                           and Q=UNIV in ccorres_mapM_x_whileQ) apply clarsimp apply (rule invokeTCB_WriteRegisters_ccorres_helper [where args=args]) apply (simp add: unat_word_ariths frame_gp_registers_convs n_frameRegisters_def
                                    unat_of_nat32 word_bits_def word_of_nat_less) apply (simp add: n_frameRegisters_def n_gpRegisters_def
                                   frame_gp_registers_convs word_less_nat_alt) apply (simp add: unat_of_nat32 word_bits_def) apply arith apply clarsimp apply (vcg exspec=setRegister_modifies exspec=getSyscallArg_modifies
                            exspec=sanitiseRegister_modifies) apply clarsimp apply (simp add: sysargs_rel_n_def) apply (rule hoare_pre, wp asUser_sysargs_rel) apply (clarsimp simp: n_msgRegisters_def sysargs_rel_def) apply (simp add: frame_gp_registers_convs n_frameRegisters_def word_bits_def) apply simp apply (rule ceqv_refl) apply (rule ccorres_stateAssert) apply (rule ccorres_rhs_assoc2, rule ccorres_split_nothrow_novcg) apply (rule_tac F="\<lambda>n. sysargs_rel args buffer
                                     and sysargs_rel_n args buffer (n + length ARM_H.frameRegisters + 2)
                                     and tcb_at' dst
                                     and (\<lambda>s. dst \<noteq> ksCurThread s)"
                             and Q=UNIV in ccorres_mapM_x_whileQ) apply clarsimp apply (rule invokeTCB_WriteRegisters_ccorres_helper [where args=args]) apply (simp add: n_gpRegisters_def unat_word_ariths
                                      frame_gp_registers_convs unat_of_nat32
                                      word_bits_def n_frameRegisters_def word_of_nat_less) apply (simp add: n_frameRegisters_def n_gpRegisters_def
                                     frame_gp_registers_convs unat_of_nat32
                                     word_less_nat_alt word_bits_def less_diff_conv) apply (simp add: unat_word_ariths cong: conj_cong) apply clarsimp apply (vcg exspec=setRegister_modifies exspec=getSyscallArg_modifies
                              exspec=sanitiseRegister_modifies) apply clarsimp apply (simp add: sysargs_rel_n_def) apply (rule hoare_pre, wp asUser_sysargs_rel) apply (clarsimp simp: n_msgRegisters_def frame_gp_registers_convs
                                        n_frameRegisters_def) apply arith apply (simp add: ARM_H.gpRegisters_def word_bits_def
                                  ARM.gpRegisters_def) apply simp apply (rule ceqv_refl) apply (ctac(no_vcg) add: getRestartPC_ccorres) apply simp apply (ctac(no_vcg) add: setNextPC_ccorres) apply (ctac (no_vcg) add: postModifyRegisters_ccorres[simplified]) apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_when[where R=\<top>]) apply (simp add: from_bool_0 Collect_const_mem) apply (rule_tac xf'=Corres_C.xfdc in ccorres_call) apply (rule restart_ccorres) apply simp apply simp apply simp apply (rule ceqv_refl) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule_tac R="\<lambda>s. self = ksCurThread s" in ccorres_when) apply (clarsimp simp: rf_sr_ksCurThread) apply clarsimp apply (ctac (no_vcg) add: rescheduleRequired_ccorres) apply (unfold return_returnOk)[1] apply (rule ccorres_return_CE, simp+)[1] apply wp apply (simp add: guard_is_UNIV_def) apply (wp hoare_drop_imp) apply (rule_tac Q="\<lambda>rv. invs' and tcb_at' dst" in hoare_strengthen_post[rotated]) apply (fastforce simp: sch_act_wf_weak) apply (wpsimp wp: restart_invs')+ apply (clarsimp simp add: guard_is_UNIV_def) apply (wp hoare_drop_imp hoare_vcg_if_lift)+ apply simp apply (rule mapM_x_wp') apply (wpsimp) apply (simp add: guard_is_UNIV_def) apply (rule hoare_drop_imps) apply (simp add: sysargs_rel_n_def) apply (rule mapM_x_wp') apply (rule hoare_pre, wp asUser_sysargs_rel) apply clarsimp apply (simp add: guard_is_UNIV_def) apply (wp) apply vcg apply (wp threadGet_wp) apply vcg apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply simp apply (simp add: performTransfer_def) apply wp apply clarsimp apply vcg apply (clarsimp simp: n_msgRegisters_def sysargs_rel_n_def split: if_split) apply (rule conjI) apply (cases args, simp) apply (case_tac list, simp) apply (case_tac lista, clarsimp simp: unat_eq_0) apply simp apply (clarsimp simp: frame_gp_registers_convs word_less_nat_alt
                        sysargs_rel_def n_frameRegisters_def n_msgRegisters_def
                  split: if_split_asm) apply (simp add: invs_weak_sch_act_wf invs_valid_objs' invs_queues) apply (fastforce dest!: global'_no_ex_cap simp: invs'_def valid_state'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s) and (\<lambda>_. values = take someNum (drop 2 args) \<and> someNum + 2 \<le> length args)) (\<lbrace>unat \<acute>n = length values\<rbrace> \<inter> S \<inter> \<lbrace>unat \<acute>n = length values\<rbrace> \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr dst\<rbrace> \<inter> \<lbrace>\<acute>resumeTarget = from_bool resume\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (invokeTCB (tcbinvocation.WriteRegisters dst resume values arch)) (Call invokeTCB_WriteRegisters_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s) and (\<lambda>_. values = take someNum (drop 2 args) \<and> someNum + 2 \<le> length args)) (\<lbrace>unat \<acute>n = length values\<rbrace> \<inter> S \<inter> \<lbrace>unat \<acute>n = length values\<rbrace> \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr dst\<rbrace> \<inter> \<lbrace>\<acute>resumeTarget = from_bool resume\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (invokeTCB (tcbinvocation.WriteRegisters dst resume values arch)) (Call invokeTCB_WriteRegisters_'proc) proof (prove)
goal (1 subgoal):
 1. values = take someNum (drop 2 args) \<and> someNum + 2 \<le> length args \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) (\<lbrace>unat \<acute>n = length values\<rbrace> \<inter> S \<inter> \<lbrace>unat \<acute>n = length values\<rbrace> \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr dst\<rbrace> \<inter> \<lbrace>\<acute>resumeTarget = from_bool resume\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (invokeTCB (tcbinvocation.WriteRegisters dst resume values arch)) (Call invokeTCB_WriteRegisters_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>values = take someNum (drop 2 args); someNum + 2 \<le> length args\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) (\<lbrace>unat \<acute>n = length values\<rbrace> \<inter> S \<inter> \<lbrace>unat \<acute>n = length values\<rbrace> \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr dst\<rbrace> \<inter> \<lbrace>\<acute>resumeTarget = from_bool resume\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (invokeTCB (tcbinvocation.WriteRegisters dst resume values arch)) (Call invokeTCB_WriteRegisters_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera resumeTarget dest n. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2028 buffera resumeTarget dest n) (?Q'2028 buffera resumeTarget dest n) [SKIP] (liftE (do self <- getCurThread;
y <- performTransfer arch self dst;
t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return []
od)) (lvar_nondet_init i_' i_'_update;;
(lvar_nondet_init pc_' pc_'_update;;
(lvar_nondet_init e_' e_'_update;;
(lvar_nondet_init archInfo_' archInfo_'_update;;
(\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,\<acute>ksCurThread,dest);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(dest);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(dest)
FI;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))))
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> ?Q2028 buffera resumeTarget dest n s \<and> s' \<in> ?Q'2028 buffera resumeTarget dest n proof (prove)
goal (2 subgoals):
 1. \<And>buffera resumeTarget dest n. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2028 buffera resumeTarget dest n) (?Q'2028 buffera resumeTarget dest n) [SKIP] (liftE (do self <- getCurThread;
y <- performTransfer arch self dst;
t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return []
od)) (lvar_nondet_init i_' i_'_update;;
(lvar_nondet_init pc_' pc_'_update;;
(lvar_nondet_init e_' e_'_update;;
(lvar_nondet_init archInfo_' archInfo_'_update;;
(\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,\<acute>ksCurThread,dest);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(dest);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(dest)
FI;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))))))
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> ?Q2028 buffera resumeTarget dest n s \<and> s' \<in> ?Q'2028 buffera resumeTarget dest n proof (prove)
goal (2 subgoals):
 1. \<And>buffera resumeTarget dest n. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2028 buffera resumeTarget dest n) (?G'2069 buffera resumeTarget dest n) [SKIP] (liftE (do self <- getCurThread;
y <- performTransfer arch self dst;
t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return []
od)) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,\<acute>ksCurThread,dest);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(dest);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(IF resumeTarget \<noteq> 0 THEN
  CALL restart_'proc(dest)
FI;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> ?Q2028 buffera resumeTarget dest n s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> ?G'2069 buffera resumeTarget dest n}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera resumeTarget dest n. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2028 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n) (?G'2069 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n) [SKIP] (do self <- getCurThread;
y <- performTransfer arch self dst;
t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> ?Q2028 buffera resumeTarget dest n s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> ?G'2069 buffera resumeTarget dest n}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P2087 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n a self) (?P'2088 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) [SKIP] (do y <- performTransfer arch self dst;
t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P2087 buffera resumeTarget dest n s rv) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'2088 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ?s2092 buffera resumeTarget dest n self = do y <- performTransfer arch self dst;
t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od
 2. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2098 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) (?P'2088 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) [SKIP] (?s2092 buffera resumeTarget dest n self) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 3. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P2098 buffera resumeTarget dest n rv s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'2088 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2098 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) (?P'2088 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) [SKIP] (doE y <- liftE (performTransfer arch self dst);
do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od
odE) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P2098 buffera resumeTarget dest n rv s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'2088 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera resumeTarget dest n self rv e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; dc rv (K () e); id e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2105 buffera resumeTarget dest n self rv) (?Q'2105 buffera resumeTarget dest n self rv e) [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (IF e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. e)
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 2. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 3. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>?Q2105 buffera resumeTarget dest n self\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 4. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> ?Q'2105 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 5. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2105 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()) (?Q'2105 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 3. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>?Q2105 buffera resumeTarget dest n self\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 4. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> ?Q'2105 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 5. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2105 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()) (?Q'2105 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do _ <- return ();
t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 3. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>?Q2105 buffera resumeTarget dest n self\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 4. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> ?Q'2105 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 5. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) n_' (?P2676 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()) (?P'2669 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (return ()) (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI))
 2. \<And>buffera resumeTarget dest n self e rv' t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))) (?d'2659 buffera resumeTarget dest n self e rv')
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2659 buffera resumeTarget dest n self e rv) (?Q'2659 buffera resumeTarget dest n self e rv rv') [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'2659 buffera resumeTarget dest n self e rv')
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>?Q2659 buffera resumeTarget dest n self e\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> ?Q'2659 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. ?P2676 buffera resumeTarget dest n self a and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> ?P'2669 buffera resumeTarget dest n self rv (e_' s) \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)}
 2. \<And>buffera resumeTarget dest n self e rv' t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))) (?d'2659 buffera resumeTarget dest n self e rv')
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2659 buffera resumeTarget dest n self e rv) (?Q'2659 buffera resumeTarget dest n self e rv rv') [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'2659 buffera resumeTarget dest n self e rv')
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>?Q2659 buffera resumeTarget dest n self e\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> ?Q'2659 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e \<sigma>. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<and> (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n \<longrightarrow> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<and> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', n_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters)) s) \<in> rf_sr \<and> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters))) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)))}
 2. \<And>buffera resumeTarget dest n self e rv' t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))) (?d'2659 buffera resumeTarget dest n self e rv')
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2659 buffera resumeTarget dest n self e rv) (?Q'2659 buffera resumeTarget dest n self e rv rv') [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'2659 buffera resumeTarget dest n self e rv')
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>?Q2659 buffera resumeTarget dest n self e\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> ?Q'2659 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>values = take (unat (n_' x)) (drop 2 args); Suc (Suc (unat (n_' x))) \<le> length args; someNum = unat (n_' x); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<and> (SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n_' x \<longrightarrow> - 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<and> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) = (if n_' x \<le> SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters then n_' x else SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n_' x \<longrightarrow> n_' x = (if n_' x \<le> SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters then n_' x else SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters))
 2. \<And>buffera resumeTarget dest n self e rv' t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))) (?d'2659 buffera resumeTarget dest n self e rv')
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2659 buffera resumeTarget dest n self e rv) (?Q'2659 buffera resumeTarget dest n self e rv rv') [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'2659 buffera resumeTarget dest n self e rv')
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>?Q2659 buffera resumeTarget dest n self e\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> ?Q'2659 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))) (?d'2659 buffera resumeTarget dest n self e rv')
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2659 buffera resumeTarget dest n self e rv) (?Q'2659 buffera resumeTarget dest n self e rv rv') [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'2659 buffera resumeTarget dest n self e rv')
 3. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>?Q2659 buffera resumeTarget dest n self e\<rbrace>
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> ?Q'2659 buffera resumeTarget dest n self e rv (n_' s)}
 5. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 6. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 8. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2659 buffera resumeTarget dest n self e rv) (?Q'2659 buffera resumeTarget dest n self e rv rv') [SKIP] (do t <- local.getSanitiseRegisterInfo dst;
y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister t r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < rv'\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < rv'\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>?Q2659 buffera resumeTarget dest n self e\<rbrace>
 3. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> ?Q'2659 buffera resumeTarget dest n self e rv (n_' s)}
 4. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 5. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 6. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 7. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); ((=) \<circ> from_bool) rva archInfo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3156 buffera resumeTarget dest n self e rv rv' rva) (?Q'3156 buffera resumeTarget dest n self e rv rv' rva archInfo) [SKIP] (do y <- asUser dst (do y <- zipWithM (\<lambda>r v. setRegister r (local.sanitiseRegister rva r v)) (TCB_H.frameRegisters @ TCB_H.gpRegisters) (take someNum (drop 2 args));
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < rv'\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < rv'\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>?Q3156 buffera resumeTarget dest n self e rv rv'\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rva. ((=) \<circ> from_bool) rva (archInfo_' s) \<longrightarrow> s \<in> ?Q'3156 buffera resumeTarget dest n self e rv rv' rva (archInfo_' s)}
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva) (?Q'3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo) [SKIP] (do y <- asUser dst (do _ <- do y <- mapM_x (\<lambda>p. setRegister (fst p) (local.sanitiseRegister rva (fst p) (snd p))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)));
mapM_x (\<lambda>p. setRegister (fst p) (local.sanitiseRegister rva (fst p) (snd p))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))
od;
getRestartPC >>= setNextPC
od);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>?Q3156 buffera resumeTarget dest n self e rv rv'\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rva. ((=) \<circ> from_bool) rva (archInfo_' s) \<longrightarrow> s \<in> ?Q'3156 buffera resumeTarget dest n self e rv rv' rva (archInfo_' s)}
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva) (?Q'3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo) [SKIP] (do rv <- asUser dst (mapM_x (\<lambda>p. setRegister (fst p) (local.sanitiseRegister rva (fst p) (snd p))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))));
rv <- asUser dst (mapM_x (\<lambda>p. setRegister (fst p) (local.sanitiseRegister rva (fst p) (snd p))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))));
rv <- asUser dst (getRegister register.FaultIP);
y <- asUser dst (setRegister register.NextIP rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>?Q3156 buffera resumeTarget dest n self e rv rv'\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rva. ((=) \<circ> from_bool) rva (archInfo_' s) \<longrightarrow> s \<in> ?Q'3156 buffera resumeTarget dest n self e rv rv' rva (archInfo_' s)}
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva) (?Q'3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo) [SKIP] (do rv <- asUser dst (mapM_x (\<lambda>p. setRegister (fst p) (local.sanitiseRegister rva (fst p) (snd p))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))));
rv <- asUser dst (mapM_x (\<lambda>p. setRegister (fst p) (local.sanitiseRegister rva (fst p) (snd p))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>?Q3156 buffera resumeTarget dest n self e rv rv'\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rva. ((=) \<circ> from_bool) rva (archInfo_' s) \<longrightarrow> s \<in> ?Q'3156 buffera resumeTarget dest n self e rv rv' rva (archInfo_' s)}
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva) (?Q'3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)));
y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>?Q3156 buffera resumeTarget dest n self e rv rv'\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rva. ((=) \<circ> from_bool) rva (archInfo_' s) \<longrightarrow> s \<in> ?Q'3156 buffera resumeTarget dest n self e rv rv' rva (archInfo_' s)}
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3581 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva) (?Q'3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo) [SKIP] (do rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)));
y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ?P3581 buffera resumeTarget dest n self e rv rv' a b\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rva. ((=) \<circ> from_bool) rva (archInfo_' s) \<longrightarrow> s \<in> ?Q'3156 buffera resumeTarget dest n self e rv rv' rva (archInfo_' s)}
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (13 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ccorres (?r'3589 buffera resumeTarget dest n self e rv' rva archInfo) (?xf'3589 buffera resumeTarget dest n self e rv' rva archInfo) (?P3600 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva) (?Q'3156 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo) [] (mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3589 buffera resumeTarget dest n self e rv' rva archInfo) rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; ?r'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3589 buffera resumeTarget dest n self e rv' rva archInfo) (?xf'3589 buffera resumeTarget dest n self e rv' rva archInfo) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> (?P3600 buffera resumeTarget dest n self e rv rv' a and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rva. ((=) \<circ> from_bool) rva (archInfo_' s) \<longrightarrow> s \<in> ?Q'3156 buffera resumeTarget dest n self e rv rv' rva (archInfo_' s)}
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 10. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
A total of 13 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>n<length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))). ccorres dc xfdc (sysargs_rel args buffer and sysargs_rel_n args buffer (n + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> UNIV) [] (asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! n)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! n)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! n))))) (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> na < n \<and> na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n rva na. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n; na < length TCB_H.frameRegisters; na < unat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (sysargs_rel args buffer and sysargs_rel_n args buffer (Suc (Suc na)) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) \<lbrace>\<acute>i = word_of_nat na\<rbrace> [] (asUser dst (setRegister (TCB_H.frameRegisters ! na) (local.sanitiseRegister rva (TCB_H.frameRegisters ! na) (args ! Suc (Suc na))))) (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,from_bool rva));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> na < n \<and> na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n rva na. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n; na < length TCB_H.frameRegisters; na < unat n\<rbrakk> \<Longrightarrow> unat (word_of_nat na + 2) = Suc (Suc na) \<and> kernel_all_global_addresses.frameRegisters.[unat (word_of_nat na)] = register_from_H (TCB_H.frameRegisters ! na) \<and> Suc (Suc na) = Suc (Suc na) \<and> word_of_nat na < 0xA \<and> word_of_nat na < 0xA
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> na < n \<and> na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> na < n \<and> na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera resumeTarget dest n e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n 0x13; from_bool rva = archInfo\<rbrakk> \<Longrightarrow> (unat na < 10 \<and> unat na < someNum \<and> unat na < 19) = (unat na < unat (word_of_nat (min 10 someNum)))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera resumeTarget dest n e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n 0x13; from_bool rva = archInfo\<rbrakk> \<Longrightarrow> (unat na < 10 \<and> unat na < someNum \<and> unat na < 19) = (unat na < 10 \<and> unat na < someNum)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>n rva s. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n; i_' s < word_of_nat (min (length TCB_H.frameRegisters) (unat n))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,from_bool rva));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>n i. \<lbrakk>Suc (Suc (unat n)) \<le> length args; i < word_of_nat (min (length TCB_H.frameRegisters) (unat n))\<rbrakk> \<Longrightarrow> i < 0xA \<longrightarrow> i = i
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)) (snd (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera resumeTarget dest n e rv' rva archInfo na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length TCB_H.frameRegisters \<and> Suc na < someNum\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and (\<lambda>s. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc na) \<longrightarrow> (\<exists>y. buffer = Some y)) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (TCB_H.frameRegisters ! na) (local.sanitiseRegister rva (TCB_H.frameRegisters ! na) (args ! Suc (Suc na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and (\<lambda>s. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (Suc na)) \<longrightarrow> (\<exists>y. buffer = Some y)) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera resumeTarget dest n e rv' rva archInfo na s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; Suc na < length TCB_H.frameRegisters \<and> Suc na < someNum; (sysargs_rel args buffer and (\<lambda>s. unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc na) \<longrightarrow> (\<exists>y. buffer = Some y)) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) s\<rbrakk> \<Longrightarrow> (dst \<noteq> ksCurThread s \<and> sysargs_rel args buffer s) \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (Suc na)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst s \<and> dst \<noteq> ksCurThread s
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) < 2 ^ word_bits
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 10. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 9. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'3589 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo rv'a)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3589 buffera resumeTarget dest n self e rv' rva archInfo rv'a)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 9. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3589 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do y <- stateAssert (tcb_at' dst) [];
rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e))))))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>?Q3589 buffera resumeTarget dest n self e rv' rva archInfo\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 8. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3844 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [SKIP] (do rv <- mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))));
rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e))))))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ?P3844 buffera resumeTarget dest n self e rv' rva archInfo rv s\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 8. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
A total of 11 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ccorres (?r'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) (?xf'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) (?P3849 buffera resumeTarget dest n self e rv' rva archInfo rv) (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) [] (mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); ?r'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) (?xf'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> (?P3849 buffera resumeTarget dest n self e rv' rva archInfo rv and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (?Q'3589 buffera resumeTarget dest n self e rv' rva archInfo)
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
A total of 15 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<forall>n<length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))). ccorres dc xfdc (sysargs_rel args buffer and sysargs_rel_n args buffer (n + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> UNIV) [] (asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! n)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! n)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! n))))) (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>n rva na. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n; na < length TCB_H.gpRegisters; na < unat n - length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (sysargs_rel args buffer and sysargs_rel_n args buffer (Suc (Suc (na + length TCB_H.frameRegisters))) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) \<lbrace>\<acute>i = word_of_nat na\<rbrace> [] (asUser dst (setRegister (TCB_H.gpRegisters ! na) (local.sanitiseRegister rva (TCB_H.gpRegisters ! na) (args ! Suc (Suc (length TCB_H.frameRegisters + na)))))) (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,from_bool rva));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>n rva na. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n; na < length TCB_H.gpRegisters; na < unat n - length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2) = Suc (Suc (length TCB_H.frameRegisters + na)) \<and> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (TCB_H.gpRegisters ! na) \<and> Suc (Suc (na + length TCB_H.frameRegisters)) = Suc (Suc (length TCB_H.frameRegisters + na)) \<and> word_of_nat na < 9 \<and> word_of_nat na < 9
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> (na < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) = (na < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera resumeTarget dest n e rv' rva archInfo rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n 0x13; from_bool rva = archInfo; rv'a = word_of_nat (min 10 someNum)\<rbrakk> \<Longrightarrow> (unat na < 9 \<and> unat (na + 0xA) < someNum \<and> unat (na + 0xA) < 19) = (unat na < 9 \<and> unat na + 10 < someNum)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<forall>s. i_' s < word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> ({s} \<inter> UNIV) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,buffera);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(dest,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) {t. i_' t = i_' s \<and> i_'_update (\<lambda>a. i_' t + 1) t \<in> UNIV}
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n rva s. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n; i_' s < word_of_nat (min (length TCB_H.gpRegisters) (unat n - length TCB_H.frameRegisters))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,from_bool rva));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n i. \<lbrakk>Suc (Suc (unat n)) \<le> length args; i < word_of_nat (min (length TCB_H.gpRegisters) (unat n - length TCB_H.frameRegisters))\<rbrakk> \<Longrightarrow> i < 9 \<longrightarrow> i = i
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); Suc na < length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and sysargs_rel_n args buffer (na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (local.sanitiseRegister rva (fst (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)) (snd (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))) ! na)))) \<lbrace>\<lambda>_. sysargs_rel args buffer and sysargs_rel_n args buffer (Suc na + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera resumeTarget dest n e rv' rva archInfo rv'a na. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); Suc na < length TCB_H.gpRegisters \<and> Suc na < someNum - length TCB_H.frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>sysargs_rel args buffer and (\<lambda>s. Suc (Suc (na + length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (na + length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y))) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace> asUser dst (setRegister (TCB_H.gpRegisters ! na) (local.sanitiseRegister rva (TCB_H.gpRegisters ! na) (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)) ! na))) \<lbrace>\<lambda>_. sysargs_rel args buffer and (\<lambda>s. Suc (Suc (Suc (na + length TCB_H.frameRegisters))) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (Suc (na + length TCB_H.frameRegisters))) \<longrightarrow> (\<exists>y. buffer = Some y))) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera resumeTarget dest n e rv' rva archInfo rv'a na s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); Suc na < length TCB_H.gpRegisters \<and> Suc na < someNum - length TCB_H.frameRegisters; (sysargs_rel args buffer and (\<lambda>s. Suc (Suc (na + length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (na + length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y))) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) s\<rbrakk> \<Longrightarrow> (dst \<noteq> ksCurThread s \<and> sysargs_rel args buffer s) \<and> (Suc (Suc (Suc (na + length TCB_H.frameRegisters))) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (Suc (na + length TCB_H.frameRegisters))) \<longrightarrow> (\<exists>y. buffer = Some y))) \<and> tcb_at' dst s \<and> dst \<noteq> ksCurThread s
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n na s y. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n; Suc na < unat n_gpRegisters; Suc na < unat n - 10; sysargs_rel args (Some y) s; 12 + na < length args; buffer = Some y; tcb_at' dst s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> 13 + na < length args
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) < 2 ^ word_bits
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'3848 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) rv'b)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rv'b)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb) (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b) [SKIP] (do rv <- asUser dst getRestartPC;
y <- asUser dst (setNextPC rv);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (\<acute>pc :== CALL getRestartPC_'proc(dest);;
(CALL setNextPC_'proc(dest,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e))))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>?Q3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (?Q'3848 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 10. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))); rvc = pc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4096 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc) (?Q'4096 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc pc) [SKIP] (do y <- asUser dst (setNextPC rvc);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (CALL setNextPC_'proc(dest,pc);;
(CALL Arch_postModifyRegisters_'proc(dest);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(dest)) SKIP;;
(IF dest = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. e)))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>?Q4096 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rvc. rvc = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'4096 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc (ret__unsigned_long_' t)})
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4096 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc) (?Q'4096 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc pc) [SKIP] (do y <- asUser dst (setNextPC pc);
y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>?Q4096 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rvc. rvc = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'4096 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc (ret__unsigned_long_' t)})
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 7. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 9. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4279 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv) (?Q'4295 n self rva archInfo pc rv xfdc) [SKIP] (do y <- asUser dst (postModifyRegisters self dst);
y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>?Q4279 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rvc. rvc = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>ta rvd. dc rvd (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4294 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc (ret__unsigned_long_' t) ta rvd}})
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>n self rva archInfo pc t rv. ?Q'4295 n self rva archInfo pc rv (xfdc t) \<equiv>\<^sup>? \<lambda>n self rva archInfo pc. ?Q'4294 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc pc proof (prove)
goal (16 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4338 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb) (?Q'4363 n self rva archInfo pc rv xfdca rvb xfdc) [SKIP] (do y <- when resume (ThreadDecls_H.restart dst);
y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>?Q4338 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rvc. rvc = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>ta rvd. dc rvd (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>tb rve. dc rve (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> ?Q'4364 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc (ret__unsigned_long_' t) ta rvd tb rve}}})
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>n self rva archInfo pc. ?Q'4364 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc pc \<equiv>\<^sup>? \<lambda>n self rva archInfo pc t rv ta rvb. ?Q'4363 n self rva archInfo pc rv (xfdc t) rvb (xfdc ta) proof (prove)
goal (20 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?P4411 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb) (?Q'4363 n self rva archInfo pc rv xfdca rvb xfdc) [] (when resume (ThreadDecls_H.restart dst)) (Cond (if resume then UNIV else {}) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)) SKIP)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; ?r'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. ?P4411 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rvc. rvc = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>ta rvd. dc rvd (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>tb rve. dc rve (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> ?Q'4364 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc (ret__unsigned_long_' t) ta rvd tb rve}}})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>n self rva archInfo pc. ?Q'4364 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc pc \<equiv>\<^sup>? \<lambda>n self rva archInfo pc t rv ta rvb. ?Q'4363 n self rva archInfo pc rv (xfdc t) rvb (xfdc ta) proof (prove)
goal (21 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> resume = (s' \<in> (if resume then UNIV else {}))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres dc (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?Pt4425 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb) (?Rt4422 n self rva archInfo pc rv xfdca rvb xfdc) [] (ThreadDecls_H.restart dst) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV dc (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> ?Pt4425 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>n self rva archInfo pc. ?Rt4423 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc pc \<equiv>\<^sup>? \<lambda>n self rva archInfo pc t rv ta rvb. ?Rt4422 n self rva archInfo pc rv (xfdc t) rvb (xfdc ta) proof (prove)
goal (20 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres dc (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?Pt4425 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb) (?Rt4422 n self rva archInfo pc rv xfdca rvb xfdc) [] (ThreadDecls_H.restart dst) (CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV dc (?xf'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> ?Pt4425 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rvc. rvc = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>ta rvd. dc rvd (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>tb rve. dc rve (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> ?Rt4423 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b rvc (ret__unsigned_long_' t) ta rvd tb rve) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
A total of 20 subgoals...
flex-flex pairs:
\<lambda>n self rva archInfo pc. ?Rt4423 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc pc \<equiv>\<^sup>? \<lambda>n self rva archInfo pc t rv ta rvb. ?Rt4422 n self rva archInfo pc rv (xfdc t) rvb (xfdc ta) proof (prove)
goal (23 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres dc (?xf''4428 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc) (?Pt4425 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb) (?C'4433 n self rva archInfo pc rv xfdca rvb xfdc) [] (ThreadDecls_H.restart dst) (Call restart_'proc)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc x y s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> globals s = globals s
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb a s t. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = ?xf''4428 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb t
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> globals (target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s) = globals s
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb)
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> ?Pt4425 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
A total of 23 subgoals...
flex-flex pairs:
\<lambda>n self rva archInfo pc t rv ta rvb. ?C'4433 n self rva archInfo pc rv (xfdc t) rvb (xfdc ta) \<equiv>\<^sup>? \<lambda>n self rva archInfo pc. ?C'4434 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc pc proof (prove)
goal (22 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc x y s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> globals s = globals s
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb a s t. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> globals (target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s) = globals s
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb)
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb a s t. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> xfdc (s\<lparr>globals := globals t\<rparr>) = xfdc t
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> globals (target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s) = globals s
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> globals (target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s) = globals s
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c t t'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'c t t' (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb rv'c)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (?d'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rv'c)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c) [SKIP] (do y <- when (dst = self) rescheduleRequired;
return (Inr [])
od) (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>?Q4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4438 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y) (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c) [] (when (dst = self) rescheduleRequired) (IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c; dc rvd rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd) (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd) [SKIP] (return (Inr [])) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace> when (dst = self) rescheduleRequired \<lbrace>?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. ?P4438 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y and ?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4404 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb)
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> self = ksCurThread s \<longrightarrow> (dst = self) = (s' \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace>)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt4447 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y) (?Rt4444 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c) [] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c; dc rvd rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd) (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd) [SKIP] (return (Inr [])) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace> when (dst = self) rescheduleRequired \<lbrace>?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c)
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> ?Pt4447 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and ?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> ?Rt4444 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt4447 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y) (?Rt4444 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c) [] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c; dc rvd rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd) (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd) [SKIP] (return (Inr [])) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace> when (dst = self) rescheduleRequired \<lbrace>?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> ?Pt4447 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and ?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> ?Rt4444 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>n self rva pc xfdca xfdcb rv'c. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt4447 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva (from_bool rva) (word_of_nat (min (length TCB_H.frameRegisters) (unat n))) (word_of_nat (min (length TCB_H.gpRegisters) (unat n - length TCB_H.frameRegisters))) pc pc () xfdca () xfdcb ()) (?Rt4444 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva (from_bool rva) (word_of_nat (min (length TCB_H.frameRegisters) (unat n))) (word_of_nat (min (length TCB_H.gpRegisters) (unat n - length TCB_H.frameRegisters))) pc pc () xfdca () xfdcb () rv'c) [] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c; dc rvd rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd) (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd) [SKIP] (return (Inr [])) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace> when (dst = self) rescheduleRequired \<lbrace>?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c)
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> ?Pt4447 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and ?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> ?Rt4444 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c; dc rvd rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd) (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd) [SKIP] (return (Inr [])) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace> when (dst = self) rescheduleRequired \<lbrace>?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and ?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c; dc rvd rv'd\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd) (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c rvd rv'd) [SKIP] (returnOk []) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace> when (dst = self) rescheduleRequired \<lbrace>?Q4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'4437 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c)
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and ?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; dc y rv'c\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace> when (dst = self) rescheduleRequired \<lbrace>\<lambda>rvd _. True\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvd rv'd. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> [] = []\<rbrace>)
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and ?R4439 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc y\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb y rv'c. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb; dc y rv'c\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvd rv'd. \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> [] = []\<rbrace>)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and (\<lambda>_. True)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> when resume (ThreadDecls_H.restart dst) \<lbrace>\<lambda>y. (\<lambda>s. self = ksCurThread s) and (\<lambda>s. dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) and (\<lambda>s. dst \<noteq> self \<longrightarrow> True) and (\<lambda>_. True)\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and ?R4409 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; resume\<rbrakk> \<Longrightarrow> \<lbrace>?P4517 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> ThreadDecls_H.restart dst \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; resume\<rbrakk> \<Longrightarrow> \<lbrace>?P'4518 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> ThreadDecls_H.restart dst \<lbrace>\<lambda>rv s. (dst \<noteq> self \<longrightarrow> True) \<and> True\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (if resume then \<lambda>b. self = ksCurThread b \<and> ?P4517 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a b \<and> ?P'4518 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a b else (\<lambda>s. self = ksCurThread s \<and> (dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) \<and> (dst \<noteq> self \<longrightarrow> True) \<and> True))\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc rvd s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; resume; (invs' and tcb_at' dst) s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; resume\<rbrakk> \<Longrightarrow> \<lbrace>?P4517 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> ThreadDecls_H.restart dst \<lbrace>\<lambda>rv. invs' and tcb_at' dst\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; resume\<rbrakk> \<Longrightarrow> \<lbrace>?P'4518 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> ThreadDecls_H.restart dst \<lbrace>\<lambda>rv s. (dst \<noteq> self \<longrightarrow> True) \<and> True\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (if resume then \<lambda>b. self = ksCurThread b \<and> ?P4517 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a b \<and> ?P'4518 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a b else (\<lambda>s. self = ksCurThread s \<and> (dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) \<and> (dst \<noteq> self \<longrightarrow> True) \<and> True))\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; resume\<rbrakk> \<Longrightarrow> \<lbrace>?P4517 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> ThreadDecls_H.restart dst \<lbrace>\<lambda>rv. invs' and tcb_at' dst\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdc; resume\<rbrakk> \<Longrightarrow> \<lbrace>?P'4518 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb\<rbrace> ThreadDecls_H.restart dst \<lbrace>\<lambda>rv s. (dst \<noteq> self \<longrightarrow> True) \<and> True\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdca rvb xfdcb. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'c. {s. (s \<in> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> {s. s \<in> UNIV}) \<and> (s \<notin> \<lbrace>tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread\<rbrace> \<longrightarrow> s \<in> UNIV)})
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (if resume then \<lambda>b. self = ksCurThread b \<and> ?P4517 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a b \<and> ?P'4518 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc a b else (\<lambda>s. self = ksCurThread s \<and> (dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) \<and> (dst \<noteq> self \<longrightarrow> True) \<and> True))\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 9. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
A total of 18 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>y rv'c. UNIV)
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (if resume then \<lambda>a. self = ksCurThread a \<and> ((invs' and ex_nonz_cap_to' dst and (\<lambda>s. dst \<noteq> ksIdleThread s)) a \<and> tcb_at' dst a) \<and> (dst \<noteq> self \<longrightarrow> True) \<and> True else (\<lambda>s. self = ksCurThread s \<and> (dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) \<and> (dst \<noteq> self \<longrightarrow> True) \<and> True))\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 8. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 10. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv xfdc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc rv\<rbrace> asUser dst (postModifyRegisters self dst) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. resume \<longrightarrow> (invs' and tcb_at' dst and sch_act_simple) s) and (\<lambda>s. \<not> resume \<longrightarrow> True) and (if resume then \<lambda>a. self = ksCurThread a \<and> ((invs' and ex_nonz_cap_to' dst and (\<lambda>s. dst \<noteq> ksIdleThread s)) a \<and> tcb_at' dst a) \<and> (dst \<noteq> self \<longrightarrow> True) \<and> True else (\<lambda>s. self = ksCurThread s \<and> (dst = self \<longrightarrow> (Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs') s) \<and> (dst \<noteq> self \<longrightarrow> True) \<and> True))\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); rv'b = word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters)); rvc = pc\<rbrakk> \<Longrightarrow> \<lbrace>?R4289 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo () (word_of_nat (min (length TCB_H.frameRegisters) someNum)) () (word_of_nat (min (length TCB_H.gpRegisters) (someNum - length TCB_H.frameRegisters))) pc\<rbrace> asUser dst (setNextPC pc) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4352 buffera resumeTarget dest n self e rv' rva archInfo rv'a rv'b rvc pc a\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))); rv'b = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace> asUser dst getRestartPC \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4289 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb rv'b a\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?R4098 buffera resumeTarget dest n self e rv' rva archInfo rv rv'a rvb\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 6. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3850 buffera resumeTarget dest n self e rv' rva archInfo rv) s\<rbrace>
 7. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 8. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 9. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 10. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
A total of 15 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>?P'4961 buffera resumeTarget dest n self e rv' rva archInfo rv\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rv s. invs' s \<and> tcb_at' dst s \<and> tcb_at' dst s \<and> tcb_at' dst s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> True \<and> self = ksCurThread s \<and> (invs' and tcb_at' dst) s \<and> tcb_at' dst s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> (True \<and> True) \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> True \<and> True\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> ?P'4961 buffera resumeTarget dest n self e rv' rva archInfo rv s)) s\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 9. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum)\<rbrakk> \<Longrightarrow> \<lbrace>?P'4961 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva archInfo ()\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))) \<lbrace>\<lambda>rv s. invs' s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> invs' s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> ?P'4961 buffera resumeTarget dest n self e rv' rva archInfo rv s)) s\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 9. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv'a x. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (min (length TCB_H.frameRegisters) someNum); x \<in> set (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace> asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x))) \<lbrace>\<lambda>rv a. invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> invs' s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> invs' s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) s\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 6. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 8. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 9. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo rv rv'a. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; rv'a = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.gpRegisters (drop (length TCB_H.frameRegisters) (take someNum (drop 2 args)))))) i_' (\<lambda>rvb rv'b. {s. thread_'_update (\<lambda>_. dest) s \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> pc_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. v_'_update (\<lambda>_. ret__unsigned_long_' t) (thread_'_update (\<lambda>_. dest) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = dest\<rbrace> \<inter> \<lbrace>\<acute>v = \<^bsup>t\<^esup>ret__unsigned_long\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. tptr_'_update (\<lambda>_. dest) s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (s \<in> (if resume then UNIV else {}) \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. dest) s \<in> UNIV \<inter> \<lbrace>\<acute>target = dest\<rbrace>}) \<and> (s \<notin> (if resume then UNIV else {}) \<longrightarrow> s \<in> UNIV)}}}})
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> invs' s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> invs' s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) s\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 5. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 7. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 8. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 10. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. tcb_at' dst s \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> invs' s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> invs' s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)) s\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 7. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 10. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv. (\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> 0 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + length TCB_H.frameRegisters + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>s. True \<and> True \<and> True \<and> True \<and> invs' s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> invs' s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s)\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 7. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 10. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3598 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () (min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)) rva\<rbrace> mapM_x (\<lambda>x. asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x)))) (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))) \<lbrace>\<lambda>rv s. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer s \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst s \<and> dst \<noteq> ksCurThread s) \<and> invs' s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> invs' s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and ?R3598 buffera resumeTarget dest n self e rv rv' a) b\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 7. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 10. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo x. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; x \<in> set (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace> asUser dst (setRegister (fst x) (local.sanitiseRegister rva (fst x) (snd x))) \<lbrace>\<lambda>rv a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) b\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 7. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 10. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo x s. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo; x \<in> set (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))); (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer s \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst s \<and> dst \<noteq> ksCurThread s) \<and> invs' s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> invs' s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (dst \<noteq> ksCurThread s \<and> sysargs_rel args buffer s) \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst s \<and> dst \<noteq> ksCurThread s) \<and> (invs' and tcb_at' dst) s \<and> tcb_at' dst s \<and> sch_act_simple s \<and> self = ksCurThread s \<and> (invs' and tcb_at' dst) s \<and> tcb_at' dst s \<and> ex_nonz_cap_to' dst s \<and> dst \<noteq> ksIdleThread s \<and> tcb_at' dst s \<and> self = ksCurThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s
 2. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) b\<rbrace>
 4. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 6. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 7. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 9. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 10. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv' rva archInfo. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters); from_bool rva = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.frameRegisters (take (min (length TCB_H.frameRegisters) someNum) (drop 2 args))))) i_' (\<lambda>rv rv'a. {s. i_'_update (\<lambda>a. 0) s \<in> UNIV})
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) b\<rbrace>
 3. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 5. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 6. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 8. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 9. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R3158 buffera resumeTarget dest n self e rv\<rbrace> local.getSanitiseRegisterInfo dst \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) b\<rbrace>
 2. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 3. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?R3158 buffera resumeTarget dest n self e rv\<rbrace>
 4. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 5. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 6. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 7. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 8. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera resumeTarget dest n self e rv rv'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3156 buffera resumeTarget dest n self e rv rv') \<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst) {s. \<forall>rv. ((=) \<circ> from_bool) rv (archInfo_' s) \<longrightarrow> s \<in> {s. i_'_update (\<lambda>a. 0) s \<in> UNIV}}
 2. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) a)\<rbrace>
 3. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> ?R'3156 buffera resumeTarget dest n self e rv (n_' s)}
 4. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 5. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 6. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 7. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2674 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self ()\<rbrace> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) a)\<rbrace>
 2. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> \<lbrace>\<forall>rv. from_bool rv = SCAST(32 signed \<rightarrow> 32) 0 \<longrightarrow> True\<rbrace>}
 3. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 4. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2674 buffera resumeTarget dest n self a\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 5. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 6. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera resumeTarget dest n self e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F2659 buffera resumeTarget dest n self e\<^esub> (?R'2668 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI) {s. \<forall>rv. n_' s = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dst) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr dst\<rbrace>} \<inter> \<lbrace>\<forall>rv. from_bool rv = SCAST(32 signed \<rightarrow> 32) 0 \<longrightarrow> True\<rbrace>}
 2. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 3. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) a))\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 4. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> ?R'2668 buffera resumeTarget dest n self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 5. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE2105 buffera resumeTarget dest n self err) (?Q''2105 buffera resumeTarget dest n self err rv' e) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 2. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) a))\<rbrace>, \<lbrace>?QE2105 buffera resumeTarget dest n self\<rbrace>
 3. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<longrightarrow> \<not> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n \<longrightarrow> \<acute>n = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> True \<and> dest = dest\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''2105 buffera resumeTarget dest n self err (e_' s) (errstate s)))}
 4. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera resumeTarget dest n self err rv' e. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') e\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>rv rv'. rv = [])) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>_. True) UNIV [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (IF SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n THEN
  Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647\<rbrace> (\<acute>n :== SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters))
FI);;
(\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(tcb_ptr_to_ctcb_ptr dst);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.frameRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < \<acute>n\<rbrace> (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 2,option_to_ptr buffer);;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>unsigned_long_eret_2 :== CALL sanitiseRegister_'proc(kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>ret__unsigned_long,\<acute>archInfo));;
Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr dst,kernel_all_global_addresses.gpRegisters.[unat \<acute>i],\<acute>unsigned_long_eret_2));;
\<acute>i :== \<acute>i + 1);;
(\<acute>pc :== CALL getRestartPC_'proc(tcb_ptr_to_ctcb_ptr dst);;
(CALL setNextPC_'proc(tcb_ptr_to_ctcb_ptr dst,\<acute>pc);;
(CALL Arch_postModifyRegisters_'proc(tcb_ptr_to_ctcb_ptr dst);;
(IF resume THEN
  CALL restart_'proc(tcb_ptr_to_ctcb_ptr dst)
FI;;
(IF tcb_ptr_to_ctcb_ptr dst = \<acute>ksCurThread THEN
  CALL rescheduleRequired_'proc()
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 2. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) a))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<longrightarrow> \<not> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n \<longrightarrow> \<acute>n = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> True \<and> dest = dest\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 4. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> liftE (performTransfer arch self dst) \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> ((\<lambda>a. 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer (0 + 2) and tcb_at' dst and (\<lambda>s. dst \<noteq> ksCurThread s)) a) and (\<lambda>a. (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> tcb_at' dst a \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> tcb_at' dst a \<and> sch_act_simple a \<and> self = ksCurThread a \<and> invs' a \<and> tcb_at' dst a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> tcb_at' dst a \<and> self = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) a))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<longrightarrow> \<not> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n \<longrightarrow> \<acute>n = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> True \<and> dest = dest\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 3. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<lbrace>?R2120 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self\<rbrace> return () \<lbrace>\<lambda>a b. tcb_at' dst b \<longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer b \<and> sysargs_rel_n args buffer (Suc (Suc 0)) b \<and> dst \<noteq> ksCurThread b) \<and> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer b \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> dst \<noteq> ksCurThread b) \<and> invs' b \<and> sch_act_simple b \<and> self = ksCurThread b \<and> invs' b \<and> ex_nonz_cap_to' dst b \<and> dst \<noteq> ksIdleThread b \<and> self = ksCurThread b \<and> Invariants_H.valid_queues b \<and> weak_sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b\<rbrace>
 2. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<longrightarrow> \<not> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n \<longrightarrow> \<acute>n = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> True \<and> dest = dest\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 3. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R2120 buffera resumeTarget dest n rv) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera resumeTarget dest n self. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>- 2147483648 \<le> sint n_frameRegisters + sint n_gpRegisters \<and> sint n_frameRegisters + sint n_gpRegisters \<le> 2147483647 \<longrightarrow> \<not> SCAST(32 signed \<rightarrow> 32) (n_frameRegisters + n_gpRegisters) < n \<longrightarrow> \<acute>n = min n (SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters) \<longrightarrow> True \<and> dest = dest\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc (Suc 0)) a \<and> dst \<noteq> ksCurThread a) \<and> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> sch_act_simple a \<and> rv = ksCurThread a \<and> invs' a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> rv = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>n self. \<lbrakk>values = take (unat n) (drop 2 args); Suc (Suc (unat n)) \<le> length args; someNum = unat n\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2113 (option_to_ptr buffer) (from_bool resume) (tcb_ptr_to_ctcb_ptr dst) n self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>ksCurThread,tcb_ptr_to_ctcb_ptr dst) \<lbrace>\<acute>e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>n = n\<rbrace>
 2. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc (Suc 0)) a \<and> dst \<noteq> ksCurThread a) \<and> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> sch_act_simple a \<and> rv = ksCurThread a \<and> invs' a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> rv = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> ?R'2113 buffera resumeTarget dest n rv}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>buffera resumeTarget dest n s s'. \<lbrakk>values = take someNum (drop 2 args); Suc (Suc someNum) \<le> length args; buffera = option_to_ptr buffer; resumeTarget = from_bool resume; dest = tcb_ptr_to_ctcb_ptr dst; unat n = someNum; (s, s') \<in> rf_sr; (invs' and tcb_at' dst and ex_nonz_cap_to' dst and sch_act_simple and sysargs_rel args buffer and (\<lambda>s. dst \<noteq> ksCurThread s)) s; s' \<in> \<lbrace>unat \<acute>n = someNum\<rbrace> \<inter> S\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. tcb_at' dst a \<longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc (Suc 0)) a \<and> dst \<noteq> ksCurThread a) \<and> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> sysargs_rel args buffer a \<and> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> Suc (Suc (length TCB_H.frameRegisters)) \<longrightarrow> (\<exists>y. buffer = Some y)) \<and> dst \<noteq> ksCurThread a) \<and> invs' a \<and> sch_act_simple a \<and> rv = ksCurThread a \<and> invs' a \<and> ex_nonz_cap_to' dst a \<and> dst \<noteq> ksIdleThread a \<and> rv = ksCurThread a \<and> Invariants_H.valid_queues a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)) s) \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pc_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. e_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. archInfo_'_update (\<lambda>_. v) s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. dest) (tcb_src_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> UNIV} \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>n = n\<rbrace>}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n_' s' \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc 0) < length args) \<and> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n_' s' \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (2 \<le> length TCB_H.frameRegisters \<longrightarrow> (\<exists>y. buffer = Some y))) \<and> dst \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n_' s' \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc 0) < length args
 2. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n_' s' \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (2 \<le> length TCB_H.frameRegisters \<longrightarrow> (\<exists>y. buffer = Some y))) \<and> dst \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' a list. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s; args = a # list\<rbrakk> \<Longrightarrow> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n_' s' \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc 0) < length args
 2. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n_' s' \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (2 \<le> length TCB_H.frameRegisters \<longrightarrow> (\<exists>y. buffer = Some y))) \<and> dst \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' a list aa lista. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s; args = a # list; list = aa # lista\<rbrakk> \<Longrightarrow> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n_' s' \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc 0) < length args
 2. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n_' s' \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (2 \<le> length TCB_H.frameRegisters \<longrightarrow> (\<exists>y. buffer = Some y))) \<and> dst \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' a list aa lista ab listb. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s; args = a # list; list = aa # lista; lista = ab # listb\<rbrakk> \<Longrightarrow> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> 0 < n_' s' \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc 0) < length args
 2. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n_' s' \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (2 \<le> length TCB_H.frameRegisters \<longrightarrow> (\<exists>y. buffer = Some y))) \<and> dst \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; sysargs_rel args buffer s; dst \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> (0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n_' s' \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters + SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> Suc (Suc (length TCB_H.frameRegisters)) < length args \<and> (2 \<le> length TCB_H.frameRegisters \<longrightarrow> (\<exists>y. buffer = Some y))) \<and> dst \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; dst \<noteq> ksCurThread s; cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; getMRs_rel args buffer s; 4 < length args \<longrightarrow> (\<exists>y. buffer = Some y)\<rbrakk> \<Longrightarrow> dst \<noteq> ksIdleThread s \<and> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>values = take (unat (n_' s')) (drop 2 args); Suc (Suc (unat (n_' s'))) \<le> length args; (s, s') \<in> rf_sr; someNum = unat (n_' s'); invs' s; s' \<in> S; tcb_at' dst s; ex_nonz_cap_to' dst s; sch_act_simple s; dst \<noteq> ksCurThread s; cur_tcb' s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; getMRs_rel args buffer s; 4 < length args \<longrightarrow> (\<exists>y. buffer = Some y)\<rbrakk> \<Longrightarrow> dst \<noteq> ksIdleThread s proof (prove)
goal:
No subgoals!