theory Tcb_C

lemma decodeCopyRegisters_ccorres:
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc)  (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and sch_act_simple
              and (\<lambda>s. ksCurThread s = thread) and ct_active'
              and (excaps_in_mem extraCaps o ctes_of)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             ex_cte_cap_wp_to' isCNodeCap (snd v) s)
              and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp)
              and (\<lambda>s. \<forall>v \<in> set extraCaps. \<forall>y \<in> zobj_refs' (fst v).
                              ex_nonz_cap_to' y s)
              and sysargs_rel args buffer
              and K (isThreadCap cp))
       (UNIV
            \<inter> {s. ccap_relation cp (cap_' s)}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (decodeCopyRegisters args cp (map fst extraCaps)
            >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeCopyRegisters_'proc)" apply (cinit' lift: cap_' length___unsigned_long_' current_extra_caps_' buffer_' simp: decodeCopyRegisters_def) apply csymbr apply wpc apply (simp add: if_1_0_0 unat_eq_0) apply (rule ccorres_cond_true_seq) apply (simp add: invocationCatch_def throwError_bind
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: if_1_0_0 del: Collect_const) apply (subst unat_eq_0[symmetric], simp add: Collect_False del: Collect_const) apply csymbr apply (simp add: if_1_0_0 interpret_excaps_test_null decodeTransfer_def
               del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: excaps_map_def invocationCatch_def throwError_bind null_def
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: excaps_map_def null_def del: Collect_const) apply (rule ccorres_add_return,
          ctac add: getSyscallArg_ccorres_foo[where args=args and n=0 and buffer=buffer]) apply (rule ccorres_symb_exec_r) apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply (rule ccorres_move_c_guard_cte) apply ctac apply csymbr apply (simp add: cap_get_tag_isCap if_1_0_0 del: Collect_const) apply (rule ccorres_assert2) apply (rule ccorres_Cond_rhs_Seq) apply (rule_tac P="Q' (capTCBPtr rva) rva" for Q'
                     in ccorres_inst) apply (rule ccorres_rhs_assoc)+ apply (csymbr, csymbr) apply (simp add: hd_map del: Collect_const,
                 simp add: hd_conv_nth del: Collect_const) apply (simp only: cap_get_tag_isCap[symmetric],
                 drule(1) cap_get_tag_to_H) apply (simp add: case_bool_If if_to_top_of_bindE
                           if_to_top_of_bind
                      del: Collect_const cong: if_cong) apply (simp add: returnOk_bind Collect_True
                           ccorres_invocationCatch_Inr performInvocation_def
                      del: Collect_const) apply (ctac add: setThreadState_ccorres) apply csymbr apply (rule ccorres_Guard_Seq)+ apply (ctac add: invokeTCB_CopyRegisters_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (simp add: cintr_def intr_and_se_rel_def exception_defs) apply (vcg exspec=invokeTCB_CopyRegisters_modifies) apply (wp sts_invs_minor') apply (simp add: Collect_const_mem) apply (vcg exspec=setThreadState_modifies) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (simp add: hd_map isCap_simps hd_conv_nth) apply (clarsimp simp: invocationCatch_def throwError_bind
                        split: capability.split,
                auto simp: throwError_def return_def intr_and_se_rel_def
                           syscall_error_rel_def syscall_error_to_H_cases
                           exception_defs)[1] apply (simp add: getSlotCap_def) apply (wp getCTE_wp) apply (simp add: Collect_const_mem if_1_0_0 cap_get_tag_isCap) apply vcg apply (simp add: Collect_const_mem) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply wp apply (simp add: Collect_const_mem) apply (vcg exspec=getSyscallArg_modifies) apply (clarsimp simp: Collect_const_mem excaps_map_Nil) apply (rule conjI) apply (clarsimp simp: excaps_in_mem_def neq_Nil_conv
                         slotcap_in_mem_def cte_wp_at_ctes_of
                         ct_in_state'_def pred_tcb_at') apply (rule conjI) apply (clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (cut_tac msk=ba and cap="cteCap cte" in capMasterCap_maskCapRights) apply (clarsimp simp: isCap_simps simp del: capMasterCap_maskCapRights) apply (frule ctes_of_valid', clarsimp+) apply (auto simp: valid_cap'_def excaps_map_def valid_tcb_state'_def
              elim!: pred_tcb'_weakenE
              dest!: st_tcb_at_idle_thread' interpret_excaps_eq)[1] apply (clarsimp simp: word_sle_def CopyRegistersFlags_defs word_sless_def
                        "StrictC'_thread_state_defs" rf_sr_ksCurThread
                 split: if_split) apply (drule interpret_excaps_eq) apply (clarsimp simp: mask_def excaps_map_def split_def ccap_rights_relation_def
                        rightsFromWord_wordFromRights excaps_map_Nil) apply (simp only: cap_get_tag_isCap[symmetric],
         drule(1) cap_get_tag_to_H) apply (clarsimp simp: cap_get_tag_isCap to_bool_def) apply (auto simp: unat_eq_of_nat word_and_1_shiftls
    word_and_1_shiftl [where n=3,simplified] cap_get_tag_isCap[symmetric] split: if_split_asm) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and K (isThreadCap cp)) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeCopyRegisters args cp (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeCopyRegisters_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2755 buffera current_extra_caps length___unsigned_long cap) (?Q'2755 buffera current_extra_caps length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | flags # x \<Rightarrow> doE suspendSource <- returnOk (flags !! 0);
resumeTarget <- returnOk (flags !! 1);
transferFrame <- returnOk (flags !! 2);
transferInteger <- returnOk (flags !! 3);
transferArch <- decodeTransfer $ fromIntegral $ flags `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2755 buffera current_extra_caps length___unsigned_long cap s \<and> s' \<in> ?Q'2755 buffera current_extra_caps length___unsigned_long cap proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2755 buffera current_extra_caps length___unsigned_long cap) (?G'2763 buffera current_extra_caps length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | flags # x \<Rightarrow> doE suspendSource <- returnOk (flags !! 0);
resumeTarget <- returnOk (flags !! 1);
transferFrame <- returnOk (flags !! 2);
transferInteger <- returnOk (flags !! 3);
transferArch <- decodeTransfer $ fromIntegral $ flags `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2755 buffera current_extra_caps length___unsigned_long cap s \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> ?G'2763 buffera current_extra_caps length___unsigned_long cap} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2886 buffera current_extra_caps length___unsigned_long cap) (?R''2888 buffera current_extra_caps length___unsigned_long cap) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2887 buffera current_extra_caps length___unsigned_long cap x21 x22) (?R''2889 buffera current_extra_caps length___unsigned_long cap x21 x22) [SKIP] (doE suspendSource <- returnOk (x21 !! 0);
resumeTarget <- returnOk (x21 !! 1);
transferFrame <- returnOk (x21 !! 2);
transferInteger <- returnOk (x21 !! 3);
transferArch <- decodeTransfer $ fromIntegral $ x21 `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R2886 buffera current_extra_caps length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> ?R''2888 buffera current_extra_caps length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2886 (option_to_ptr buffer) extraCaps' 0 cap) (?R''2888 (option_to_ptr buffer) extraCaps' 0 cap) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s CopyRegisters_suspendSource then UNIV else {}) (Guard ShiftError (if CopyRegisters_suspendSource <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_resumeTarget then UNIV else {}) (Guard ShiftError (if CopyRegisters_resumeTarget <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferFrame then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferFrame <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferInteger then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferInteger <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2887 buffera current_extra_caps length___unsigned_long cap x21 x22) (?R''2889 buffera current_extra_caps length___unsigned_long cap x21 x22) [SKIP] (doE suspendSource <- returnOk (x21 !! 0);
resumeTarget <- returnOk (x21 !! 1);
transferFrame <- returnOk (x21 !! 2);
transferInteger <- returnOk (x21 !! 3);
transferArch <- decodeTransfer $ fromIntegral $ x21 `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R2886 buffera current_extra_caps length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> ?R''2888 buffera current_extra_caps length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2886 (option_to_ptr buffer) extraCaps' 0 cap) (?R'2910 (option_to_ptr buffer) extraCaps' 0 cap) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s CopyRegisters_suspendSource then UNIV else {}) (Guard ShiftError (if CopyRegisters_suspendSource <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_resumeTarget then UNIV else {}) (Guard ShiftError (if CopyRegisters_resumeTarget <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferFrame then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferFrame <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferInteger then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferInteger <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2887 buffera current_extra_caps length___unsigned_long cap x21 x22) (?R''2889 buffera current_extra_caps length___unsigned_long cap x21 x22) [SKIP] (doE suspendSource <- returnOk (x21 !! 0);
resumeTarget <- returnOk (x21 !! 1);
transferFrame <- returnOk (x21 !! 2);
transferInteger <- returnOk (x21 !! 3);
transferArch <- decodeTransfer $ fromIntegral $ x21 `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R2886 buffera current_extra_caps length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> ?R'2910 buffera current_extra_caps length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2886 (option_to_ptr buffer) extraCaps' 0 cap) (?R'2910 (option_to_ptr buffer) extraCaps' 0 cap) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s CopyRegisters_suspendSource then UNIV else {}) (Guard ShiftError (if CopyRegisters_suspendSource <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_resumeTarget then UNIV else {}) (Guard ShiftError (if CopyRegisters_resumeTarget <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferFrame then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferFrame <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferInteger then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferInteger <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2887 buffera current_extra_caps length___unsigned_long cap x21 x22) (?R''2889 buffera current_extra_caps length___unsigned_long cap x21 x22) [SKIP] (doE suspendSource <- returnOk (x21 !! 0);
resumeTarget <- returnOk (x21 !! 1);
transferFrame <- returnOk (x21 !! 2);
transferInteger <- returnOk (x21 !! 3);
transferArch <- decodeTransfer $ fromIntegral $ x21 `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R2886 buffera current_extra_caps length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> ?R'2910 buffera current_extra_caps length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2887 buffera current_extra_caps length___unsigned_long cap x21 x22) (?R''2889 buffera current_extra_caps length___unsigned_long cap x21 x22) [SKIP] (doE suspendSource <- returnOk (x21 !! 0);
resumeTarget <- returnOk (x21 !! 1);
transferFrame <- returnOk (x21 !! 2);
transferInteger <- returnOk (x21 !! 3);
transferArch <- decodeTransfer $ fromIntegral $ x21 `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2887 buffera current_extra_caps length___unsigned_long cap x21 x22) (?R''2889 buffera current_extra_caps length___unsigned_long cap x21 x22) [SKIP] (doE suspendSource <- returnOk (x21 !! 0);
resumeTarget <- returnOk (x21 !! 1);
transferFrame <- returnOk (x21 !! 2);
transferInteger <- returnOk (x21 !! 3);
transferArch <- decodeTransfer $ fromIntegral $ x21 `~shiftR~` 8;
whenE (null (map fst extraCaps)) $ throw Fault_H.syscall_error.TruncatedMessage;
srcTCB <- case HaskellLib_H.head (map fst extraCaps) of capability.ThreadCap ptr \<Rightarrow> returnOk ptr | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB suspendSource resumeTarget transferFrame transferInteger transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> unat 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),\<acute>srcTCB,\<acute>flags && (1 << unat CopyRegisters_suspendSource),\<acute>flags && (1 << unat CopyRegisters_resumeTarget),\<acute>flags && (1 << unat CopyRegisters_transferFrame),\<acute>flags && (1 << unat CopyRegisters_transferInteger),\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2887 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) (?R''2889 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] (doE transferArch <- decodeTransfer (UCAST(32 \<rightarrow> 8) (x21 >> 8));
y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long = 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?R''2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE transferArch <- decodeTransfer (UCAST(32 \<rightarrow> 8) (x21 >> 8));
y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''2889 buffera current_extra_caps length___unsigned_long cap x xa}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R''2925 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?R''2889 (option_to_ptr buffer) extraCaps'
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R2925 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?R2887 (option_to_ptr buffer) extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?G'2946 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE transferArch <- decodeTransfer (UCAST(32 \<rightarrow> 8) (x21 >> 8));
y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) transferArch)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'2944 buffera current_extra_caps length___unsigned_long cap x xa s}}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s. ?G'2946 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?G'2944 (option_to_ptr buffer) extraCaps'
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R2925 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?R2887 (option_to_ptr buffer) extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?G'2946 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF excaps_map extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R2887 buffera current_extra_caps length___unsigned_long cap x xa s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'2944 buffera current_extra_caps length___unsigned_long cap x xa s}}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s. ?G'2946 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?G'2944 (option_to_ptr buffer) extraCaps'
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R2925 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?R2887 (option_to_ptr buffer) extraCaps' proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; excaps_map extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3482 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?S3487 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3481 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?T3485 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> ?Q3484 buffera current_extra_caps length___unsigned_long cap x xa s) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R3483 buffera current_extra_caps length___unsigned_long cap x xa s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {sa. (excaps_map extraCaps = [] \<longrightarrow> sa \<in> ?S3480 buffera current_extra_caps length___unsigned_long cap x xa s sa) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> sa \<in> ?T3479 buffera current_extra_caps length___unsigned_long cap x xa s sa)}}}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps. ?Q3484 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?Q3482 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22)
\<lambda>buffera current_extra_caps. ?R3483 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R3481 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22)
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s sa. ?S3487 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?S3480 (option_to_ptr buffer) extraCaps'
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s sa. ?T3485 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?T3479 (option_to_ptr buffer) extraCaps' proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3482 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?S3487 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError (if 0 \<le>s CopyRegisters_suspendSource then UNIV else {}) (Guard ShiftError (if CopyRegisters_suspendSource <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_resumeTarget then UNIV else {}) (Guard ShiftError (if CopyRegisters_resumeTarget <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferFrame then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferFrame <s 0x20 then UNIV else {}) (Guard ShiftError (if 0 \<le>s CopyRegisters_transferInteger then UNIV else {}) (Guard ShiftError (if CopyRegisters_transferInteger <s 0x20 then UNIV else {}) (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3481 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?T3485 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> ?Q3484 buffera current_extra_caps length___unsigned_long cap x xa s) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R3483 buffera current_extra_caps length___unsigned_long cap x xa s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {sa. (excaps_map extraCaps = [] \<longrightarrow> sa \<in> ?S3480 buffera current_extra_caps length___unsigned_long cap x xa s sa) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> sa \<in> ?T3479 buffera current_extra_caps length___unsigned_long cap x xa s sa)}}}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps. ?Q3484 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?Q3482 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22)
\<lambda>buffera current_extra_caps. ?R3483 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R3481 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22)
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s sa. ?S3487 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?S3480 (option_to_ptr buffer) extraCaps'
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s sa. ?T3485 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?T3479 (option_to_ptr buffer) extraCaps' proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 err' ft'. \<lbrakk>interpret_excaps extraCaps' = []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3481 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?T3485 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R3483 buffera current_extra_caps length___unsigned_long cap x xa s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {sa. (excaps_map extraCaps = [] \<longrightarrow> sa \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> sa \<in> ?T3479 buffera current_extra_caps length___unsigned_long cap x xa s sa)}}}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps. ?R3483 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R3481 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22)
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s sa. ?T3485 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?T3479 (option_to_ptr buffer) extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3481 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?T3485 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE y <- whenE (null (map fst extraCaps)) (throwError Fault_H.syscall_error.TruncatedMessage);
srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R3483 buffera current_extra_caps length___unsigned_long cap x xa s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {sa. (excaps_map extraCaps = [] \<longrightarrow> sa \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> sa \<in> ?T3479 buffera current_extra_caps length___unsigned_long cap x xa s sa)}}}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps. ?R3483 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R3481 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22)
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s sa. ?T3485 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?T3479 (option_to_ptr buffer) extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3481 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) (?T3485 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(\<acute>flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,\<acute>flags && 2 ^ unat CopyRegisters_suspendSource,\<acute>flags && 2 ^ unat CopyRegisters_resumeTarget,\<acute>flags && 2 ^ unat CopyRegisters_transferFrame,\<acute>flags && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> ?R3483 buffera current_extra_caps length___unsigned_long cap x xa s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {sa. (excaps_map extraCaps = [] \<longrightarrow> sa \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> sa \<in> ?T3479 buffera current_extra_caps length___unsigned_long cap x xa s sa)}}}}}}
flex-flex pairs:
\<lambda>buffera current_extra_caps. ?R3483 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22. ?R3481 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22)
\<lambda>buffera current_extra_caps length___unsigned_long cap x21 x22 s sa. ?T3485 buffera current_extra_caps length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (?x22.2925 buffera current_extra_caps length___unsigned_long cap x21 x22) \<equiv>\<^sup>? \<lambda>buffera current_extra_caps. ?T3479 (option_to_ptr buffer) extraCaps' proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv) (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,flags && 2 ^ unat CopyRegisters_suspendSource,flags && 2 ^ unat CopyRegisters_resumeTarget,flags && 2 ^ unat CopyRegisters_transferFrame,flags && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>?Q3509 buffera current_extra_caps length___unsigned_long cap x21 x22\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv) (?Q'3970 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,flags && 2 ^ unat CopyRegisters_suspendSource,flags && 2 ^ unat CopyRegisters_resumeTarget,flags && 2 ^ unat CopyRegisters_transferFrame,flags && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (?Q'3970 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags)
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ?Q3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>?Q3509 buffera current_extra_caps length___unsigned_long cap x21 x22\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3979 buffera current_extra_caps length___unsigned_long cap x21 x22 rv) (?Q'3970 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,flags && 2 ^ unat CopyRegisters_suspendSource,flags && 2 ^ unat CopyRegisters_resumeTarget,flags && 2 ^ unat CopyRegisters_transferFrame,flags && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (?Q'3970 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags)
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P3979 buffera current_extra_caps length___unsigned_long cap x21 x22 rv s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P3979 buffera current_extra_caps length___unsigned_long cap x21 x22 a s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3984 buffera current_extra_caps length___unsigned_long cap x21 x22 rv) (?C'3981 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,flags && 2 ^ unat CopyRegisters_suspendSource,flags && 2 ^ unat CopyRegisters_resumeTarget,flags && 2 ^ unat CopyRegisters_transferFrame,flags && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (?C'3981 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A3984 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A3984 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva source_cap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ccap_relation rva source_cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva) (?Q'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva source_cap) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(source_cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,flags && 2 ^ unat CopyRegisters_suspendSource,flags && 2 ^ unat CopyRegisters_resumeTarget,flags && 2 ^ unat CopyRegisters_transferFrame,flags && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> ?Q'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva) (?G'4379 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva source_cap ret__unsigned) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,flags && 2 ^ unat CopyRegisters_suspendSource,flags && 2 ^ unat CopyRegisters_resumeTarget,flags && 2 ^ unat CopyRegisters_transferFrame,flags && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4379 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3989 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?G'4379 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF isThreadCap rva THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4379 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4556 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?G'4557 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF isThreadCap rva THEN
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> ?G4556 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'4557 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?S4568 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> ?S4568 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva) (?S4568 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(source_cap);;
\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> ?S4568 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 rva. ?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva) (?S4568 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(source_cap);;
(\<acute>srcTCB :== tcb_Ptr \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> ?S4568 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 rva. ?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigneda = cap_get_tag source_cap; rva = fst (extraCaps ! 0); isThreadCap rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva) (?G'4743 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap) ret__unsigned) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,tcb_Ptr ret__unsigned,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4743 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 rva. ?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation (fst (extraCaps ! 0)) source_cap; ret__unsigneda = cap_get_tag source_cap; rva = fst (extraCaps ! 0); isThreadCap (fst (extraCaps ! 0)); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q'4579 length___unsigned_long cap x21 x22 (fst (extraCaps ! 0)) (capTCBPtr (fst (extraCaps ! 0))) (fst (extraCaps ! 0))) (?G'4743 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (fst (extraCaps ! 0)) source_cap (cap_get_tag source_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) [SKIP] (doE srcTCB <- case fst (extraCaps ! 0) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4743 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 rva. ?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = fst (extraCaps ! 0); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q'4579 length___unsigned_long cap x21 x22 (fst (extraCaps ! 0)) (capTCBPtr (fst (extraCaps ! 0))) (fst (extraCaps ! 0))) (?G'4743 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (fst (extraCaps ! 0)) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) [SKIP] (doE srcTCB <- case fst (extraCaps ! 0) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4743 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 rva. ?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q'4579 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))) (?G'4743 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) [SKIP] (returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4743 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 rva. ?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q'4579 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))) (?G'4743 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ?Q4565 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4743 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 rva. ?Q'4579 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?Q4565 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv) (?Q'4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s)}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv) (?G'5032 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) [SKIP] (doE reply <- invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'5032 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv) (?C'5210 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) [SKIP] (doE reply <- invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4968 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'5210 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rvb = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned rvb) (?Q'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned rvb ret__unsigned_long) [SKIP] (if rvb = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rvb isCall)) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err) (?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv\<rbrace> invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters) \<lbrace>?Q5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned\<rbrace>, \<lbrace>?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) \<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned a\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> ?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb xfdc ret__unsigned rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rvb = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5216 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) []) (?Q'5216 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err) (?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv\<rbrace> invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters) \<lbrace>?Q5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned\<rbrace>, \<lbrace>?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) \<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned a\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> ?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb xfdc ret__unsigned rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); rvb = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5286 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) []) (?Q'5288 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err) (?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv\<rbrace> invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters) \<lbrace>?Q5286 buffera current_extra_caps length___unsigned_long cap x21 flags x22 rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned\<rbrace>, \<lbrace>?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) \<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'5288 buffera current_extra_caps length___unsigned_long cap x21 flags x22 rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned a\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> ?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err) (?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv\<rbrace> invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) \<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> ?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv\<rbrace> invokeTCB (tcbinvocation.CopyRegisters (capTCBPtr cp) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) \<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ?R5220 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned a\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> ?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) \<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr ret__unsigned,tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger,\<acute>transferArch) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> ?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsignedb xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsignedb = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5216 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)),tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)),x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger) UNIV
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> ?R'5216 buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (10 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<lbrace>?R4978 length___unsigned_long cap x21 x22 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_at' (capTCBPtr cp) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and ex_nonz_cap_to' (capTCBPtr cp) and ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4982 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R4982 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 rva. ?R4978 length___unsigned_long cap x21 x22 rva (capTCBPtr rva) rva
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. transferArch_'_update (\<lambda>x. transferArch_' s) (transferInteger_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferInteger) (transferFrame_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_transferFrame) (resumeTarget_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_resumeTarget) (suspendSource_'_update (\<lambda>_. x21 && 2 ^ unat CopyRegisters_suspendSource) (tcb_src_'_update (\<lambda>_. tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) (dest_'_update (\<lambda>_. tcb_Ptr v) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>dest = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrace> \<inter> \<lbrace>to_bool \<acute>resumeTarget = x21 !! Suc 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>suspendSource = x21 !! 0\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferFrame = x21 !! 2\<rbrace> \<inter> \<lbrace>to_bool \<acute>transferInteger = x21 !! 3\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> \<inter> \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> \<inter> \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> \<inter> \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ret__unsigneda = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; rva = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap)))); cap_get_tag source_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap); fst (extraCaps ! 0) = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4969 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 (capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))))) source_cap (SCAST(32 signed \<rightarrow> 32) cap_thread_cap) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift source_cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x21 && 2 ^ unat CopyRegisters_resumeTarget) = x21 !! Suc 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_suspendSource) = x21 !! 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferFrame) = x21 !! 2 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferInteger) = x21 !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. srcTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'4969 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4564 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva) (?T4566 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) [SKIP] (doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_suspendSource\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_suspendSource <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_resumeTarget\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_resumeTarget <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferFrame\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferFrame <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s CopyRegisters_transferInteger\<rbrace> (Guard ShiftError \<lbrace>CopyRegisters_transferInteger <s 0x20\<rbrace> (\<acute>ret__unsigned_long :== CALL invokeTCB_CopyRegisters_'proc(tcb_Ptr \<acute>ret__unsigned,\<acute>srcTCB,x21 && 2 ^ unat CopyRegisters_suspendSource,x21 && 2 ^ unat CopyRegisters_resumeTarget,x21 && 2 ^ unat CopyRegisters_transferFrame,x21 && 2 ^ unat CopyRegisters_transferInteger)))))))));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> ?R4564 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags a b)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4566 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5470 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21 rva source_cap (cap_get_tag source_cap)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> True)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV \<inter> ?R'5470 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags rva (source_cap_' s) v)}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> True)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation rva source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((doE srcTCB <- case hd (map fst extraCaps) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. invalidCapNumber_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (current_syscall_error_' (globals s))))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. invalidCapNumber_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (current_syscall_error_' (globals s))))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> True)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags rva source_cap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21; ccap_relation (fst (extraCaps ! 0)) source_cap; ret__unsigned = cap_get_tag source_cap; rva = fst (extraCaps ! 0); \<forall>v0. fst (extraCaps ! 0) \<noteq> capability.ThreadCap v0\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>x\<in>fst ((doE srcTCB <- case fst (extraCaps ! 0) of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
returnOk (tcbinvocation.CopyRegisters (capTCBPtr cp) srcTCB (x21 !! 0) (x21 !! Suc 0) (x21 !! 2) (x21 !! 3) copy_register_sets.ARMNoExtraRegisters)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (invalidCapNumber_C_update (\<lambda>_. 1) (current_syscall_error_' (globals s))))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> True)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> (isThreadCap a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr a) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr a) b \<and> True \<and> True)) b) \<and> (\<not> isThreadCap a \<longrightarrow> True)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21\<rbrakk> \<Longrightarrow> \<lbrace>?R3994 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 ()\<rbrace> do cte <- getCTE (snd (extraCaps ! 0));
return (cteCap cte)
od \<lbrace>\<lambda>a b. a = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) b\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3994 buffera current_extra_caps length___unsigned_long cap x21 x22 a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (source_cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (isThreadCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. srcTCB_'_update (\<lambda>_. tcb_Ptr va) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = v then UNIV else {})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. source_cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}) \<and> (\<not> isThreadCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>)}}}}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3989 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21) \<acute>source_cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) \<lbrace>ccap_relation (fst (extraCaps ! 0)) \<acute>source_cap \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x21 && 2 ^ unat CopyRegisters_resumeTarget) = x21 !! Suc 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_suspendSource) = x21 !! 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferFrame) = x21 !! 2 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferInteger) = x21 !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag \<acute>source_cap\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3989 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> \<lbrace>True\<rbrace>)
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) (\<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])))\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 flags. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = x21\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 () x21) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(x21 >> 8) ((if excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<inter> \<lbrace>ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x21 && 2 ^ unat CopyRegisters_resumeTarget) = x21 !! Suc 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_suspendSource) = x21 !! 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferFrame) = x21 !! 2 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferInteger) = x21 !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])))\<rbrace>)
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> ?Q'3509 buffera current_extra_caps length___unsigned_long cap x21 x22 rv (flags_' s)}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. \<forall>t. ret__unsigned_long_' t = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. 0) s \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>transferArch :== CALL Arch_decodeTransfer_'proc(flags >> 8) {s'. (s, s') \<in> rf_sr}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {sa. \<forall>t. ret__unsigned_long_' t = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. 0) sa \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_resumeTarget) = flags_' s !! Suc 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_suspendSource) = flags_' s !! 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferFrame) = flags_' s !! 2 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferInteger) = flags_' s !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22 rv flags s. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []; flags = args ! 0; ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s\<rbrakk> \<Longrightarrow> {s. \<forall>t. ret__unsigned_long_' t = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. 0) s \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags && 2 ^ unat CopyRegisters_resumeTarget) = flags !! Suc 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_suspendSource) = flags !! 0 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferFrame) = flags !! 2 \<and> to_bool (flags && 2 ^ unat CopyRegisters_transferInteger) = flags !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. ret__unsigned_long_' t = 0 \<longrightarrow> (s, transferArch_'_update (\<lambda>_. 0) sa) \<in> rf_sr}
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {sa. \<forall>t. ret__unsigned_long_' t = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. 0) sa \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_resumeTarget) = flags_' s !! Suc 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_suspendSource) = flags_' s !! 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferFrame) = flags_' s !! 2 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferInteger) = flags_' s !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {sa. \<forall>t. ret__unsigned_long_' t = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. 0) sa \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_resumeTarget) = flags_' s !! Suc 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_suspendSource) = flags_' s !! 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferFrame) = flags_' s !! 2 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferInteger) = flags_' s !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3530 buffera current_extra_caps length___unsigned_long cap x xa) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
?R3530 (option_to_ptr buffer) extraCaps' \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22. ?R3529 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. flags_' s = args ! 0 \<longrightarrow> s \<in> {sa. \<forall>t. ret__unsigned_long_' t = 0 \<longrightarrow> transferArch_'_update (\<lambda>_. 0) sa \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_resumeTarget) = flags_' s !! Suc 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_suspendSource) = flags_' s !! 0 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferFrame) = flags_' s !! 2 \<and> to_bool (flags_' s && 2 ^ unat CopyRegisters_transferInteger) = flags_' s !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))}}
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 (x21 # x22)) \<acute>flags :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) \<lbrace>\<acute>flags = x21 \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = 0) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x21 && 2 ^ unat CopyRegisters_resumeTarget) = x21 !! Suc 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_suspendSource) = x21 !! 0 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferFrame) = x21 !! 2 \<and> to_bool (x21 && 2 ^ unat CopyRegisters_transferInteger) = x21 !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3527 buffera current_extra_caps length___unsigned_long cap x xa)}}}}}}
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22. ?R'3528 length___unsigned_long cap x21 x22 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 args \<equiv>\<^sup>? ?R'3527 (option_to_ptr buffer) extraCaps' proof (prove)
goal (1 subgoal):
 1. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and sysargs_rel args buffer and (\<lambda>y. isThreadCap cp)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (excaps_map extraCaps = [] \<longrightarrow> True) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))) s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. (excaps_map extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (excaps_map extraCaps \<noteq> [] \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = x \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))))\<rbrace>)}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> sysargs_rel (x # xa) buffer s \<and> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) s \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) s \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) s))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)) \<and> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> sysargs_rel (x # xa) buffer s \<and> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) s \<and> (cteCap cte = fst (extraCaps ! 0) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (fst (extraCaps ! 0))) s \<and> ex_nonz_cap_to' (capTCBPtr (fst (extraCaps ! 0))) s))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b ys cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # ys); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; sysargs_rel (x # xa) buffer s; isThreadCap cp; args = x # xa; extraCaps = (cteCap cte, b) # ys; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>y\<in>zobj_refs' (cteCap cte). ex_nonz_cap_to' y s; \<forall>v\<in>set ys. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; ctes_of s b = Some cte\<rbrakk> \<Longrightarrow> sysargs_rel_n (x # xa) buffer 0 s \<and> (isThreadCap (cteCap cte) \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ex_nonz_cap_to' (capTCBPtr (cteCap cte)) s) \<and> (\<exists>cte. ctes_of s (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) = Some cte)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b ys cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # ys); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; sysargs_rel (x # xa) buffer s; isThreadCap cp; args = x # xa; extraCaps = (cteCap cte, b) # ys; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>y\<in>zobj_refs' (cteCap cte). ex_nonz_cap_to' y s; \<forall>v\<in>set ys. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; ctes_of s b = Some cte\<rbrakk> \<Longrightarrow> sysargs_rel_n (x # xa) buffer 0 s
 2. \<And>length___unsigned_long cap s s' x xa b ys cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # ys); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; sysargs_rel (x # xa) buffer s; isThreadCap cp; args = x # xa; extraCaps = (cteCap cte, b) # ys; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>y\<in>zobj_refs' (cteCap cte). ex_nonz_cap_to' y s; \<forall>v\<in>set ys. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; ctes_of s b = Some cte\<rbrakk> \<Longrightarrow> (isThreadCap (cteCap cte) \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ex_nonz_cap_to' (capTCBPtr (cteCap cte)) s) \<and> (\<exists>cte. ctes_of s (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) = Some cte)
 3. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b ys cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # ys); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; sysargs_rel (x # xa) buffer s; isThreadCap cp; args = x # xa; extraCaps = (cteCap cte, b) # ys; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>y\<in>zobj_refs' (cteCap cte). ex_nonz_cap_to' y s; \<forall>v\<in>set ys. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; ctes_of s b = Some cte\<rbrakk> \<Longrightarrow> (isThreadCap (cteCap cte) \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ex_nonz_cap_to' (capTCBPtr (cteCap cte)) s) \<and> (\<exists>cte. ctes_of s (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) = Some cte)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b ys cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # ys); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; sysargs_rel (x # xa) buffer s; isThreadCap cp; args = x # xa; extraCaps = (cteCap cte, b) # ys; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>y\<in>zobj_refs' (cteCap cte). ex_nonz_cap_to' y s; \<forall>v\<in>set ys. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; ctes_of s b = Some cte; capMasterCap (global.maskCapRights ba (cteCap cte)) = capMasterCap (cteCap cte)\<rbrakk> \<Longrightarrow> (isThreadCap (cteCap cte) \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ex_nonz_cap_to' (capTCBPtr (cteCap cte)) s) \<and> (\<exists>cte. ctes_of s (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) = Some cte)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b ys cte v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # ys); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; args = x # xa; extraCaps = (cteCap cte, b) # ys; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>y\<in>zobj_refs' (cteCap cte). ex_nonz_cap_to' y s; \<forall>v\<in>set ys. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; ctes_of s b = Some cte; capMasterCap (global.maskCapRights ba (cteCap cte)) = capMasterCap (cteCap cte); cp = capability.ThreadCap v0\<rbrakk> \<Longrightarrow> ((\<exists>v0. cteCap cte = capability.ThreadCap v0) \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ex_nonz_cap_to' (capTCBPtr (cteCap cte)) s) \<and> (\<exists>cte. ctes_of s (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) = Some cte)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b ys cte v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # ys); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; tcb_at' v0 s; ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; args = x # xa; extraCaps = (cteCap cte, b) # ys; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>y\<in>zobj_refs' (cteCap cte). ex_nonz_cap_to' y s; \<forall>v\<in>set ys. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; ctes_of s b = Some cte; cp = capability.ThreadCap v0; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> ((\<exists>v0. cteCap cte = capability.ThreadCap v0) \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr (cteCap cte)) s \<and> ex_nonz_cap_to' (capTCBPtr (cteCap cte)) s) \<and> (\<exists>cte. ctes_of s (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) = Some cte)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2 ^ unat CopyRegisters_resumeTarget) = x !! Suc 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_suspendSource) = x !! 0 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferFrame) = x !! 2 \<and> to_bool (x && 2 ^ unat CopyRegisters_transferInteger) = x !! 3 \<and> CopyRegisters_transferInteger <s 0x20 \<and> 0 \<le>s CopyRegisters_transferInteger \<and> CopyRegisters_transferFrame <s 0x20 \<and> 0 \<le>s CopyRegisters_transferFrame \<and> CopyRegisters_resumeTarget <s 0x20 \<and> 0 \<le>s CopyRegisters_resumeTarget \<and> CopyRegisters_suspendSource <s 0x20 \<and> 0 \<le>s CopyRegisters_suspendSource \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> 2 && mask 4 = 2 \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2) = x !! Suc 0 \<and> to_bool (x && 1) = x !! 0 \<and> to_bool (x && 4) = x !! 2 \<and> to_bool (x && 8) = x !! 3 \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp; \<forall>n<length (excaps_map extraCaps). excaprefs_C (current_extra_caps_' (globals s')).[n] = excaps_map extraCaps ! n \<and> (length (excaps_map extraCaps) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (excaps_map extraCaps)] = NULL)\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> 2 && mask 4 = 2 \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2) = x !! Suc 0 \<and> to_bool (x && 1) = x !! 0 \<and> to_bool (x && 4) = x !! 2 \<and> to_bool (x && 8) = x !! 3 \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; isThreadCap cp; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = cte_Ptr (snd (extraCaps ! n)) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL)\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (snd (extraCaps ! 0))\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2) = x !! Suc 0 \<and> to_bool (x && 1) = x !! 0 \<and> to_bool (x && 4) = x !! 2 \<and> to_bool (x && 8) = x !! 3 \<and> cap_get_tag cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (snd (extraCaps ! 0))\<rightarrow>[''cap_C''])))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (capTCBPtr cp) s; ex_nonz_cap_to' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = cte_Ptr (snd (extraCaps ! n)) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (snd (extraCaps ! 0))\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> to_bool (x && 2) = x !! Suc 0 \<and> to_bool (x && 1) = x !! 0 \<and> to_bool (x && 4) = x !! 2 \<and> to_bool (x && 8) = x !! 3 \<and> SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (snd (extraCaps ! 0))\<rightarrow>[''cap_C''])))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; sysargs_rel args buffer s; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = cte_Ptr (snd (extraCaps ! n)) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> length___unsigned_long = 0) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (snd (extraCaps ! 0))\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst (extraCaps ! 0)) \<longrightarrow> (x && 2 \<noteq> 0) = x !! Suc 0 \<and> (x && 1 = 1) = x !! 0 \<and> (x && 4 \<noteq> 0) = x !! 2 \<and> (x && 8 \<noteq> 0) = x !! 3 \<and> SCAST(32 signed \<rightarrow> 32) cap_thread_cap = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (snd (extraCaps ! 0))\<rightarrow>[''cap_C''])))) proof (prove)
goal:
No subgoals!