theory Tcb_C

lemma decodeSetIPCBuffer_ccorres:
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple
              and valid_cap' cp and cte_at' slot and K (isThreadCap cp)
              and (excaps_in_mem extraCaps o ctes_of)
              and (\<lambda>s. \<forall>rf \<in> zobj_refs' cp. ex_nonz_cap_to' rf s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             s \<turnstile>' fst v \<and> cte_at' (snd v) s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             ex_cte_cap_wp_to' isCNodeCap (snd v) s)
              and sysargs_rel args buffer)
       (UNIV
            \<inter> {s. ccap_relation cp (cap_' s)}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. slot_' s = cte_Ptr slot}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (decodeSetIPCBuffer args cp slot extraCaps
            >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeSetIPCBuffer_'proc)" apply (cinit' lift: cap_' length___unsigned_long_' slot_' current_extra_caps_' buffer_'
                simp: decodeSetIPCBuffer_def) apply wpc apply (simp add: unat_eq_0) apply csymbr apply simp apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (simp add: throwError_bind invocationCatch_def) apply (clarsimp simp: throwError_def return_def
                          intr_and_se_rel_def exception_defs
                          syscall_error_rel_def syscall_error_to_H_cases) apply csymbr apply (rule ccorres_cond_false_seq) apply csymbr apply (simp del: Collect_const) apply (simp add: interpret_excaps_test_null excaps_map_Nil if_1_0_0
               del: Collect_const) apply wpc apply (simp add: throwError_bind invocationCatch_def
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (rule ccorres_cond_false_seq) apply (simp add: split_def
               del: Collect_const) apply (rule ccorres_add_return,
          ctac add: getSyscallArg_ccorres_foo [where args=args and n=0 and buffer=buffer]) apply csymbr apply (rule ccorres_move_c_guard_cte) apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply ctac apply (rule ccorres_assert2) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr performInvocation_def) apply csymbr apply (ctac add: setThreadState_ccorres) apply csymbr apply csymbr apply csymbr apply (ctac add: invokeTCB_ThreadControl_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (vcg exspec=invokeTCB_ThreadControl_modifies) apply simp apply (wp sts_invs_minor') apply (vcg exspec=setThreadState_modifies) apply (simp add: bindE_assoc del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (csymbr, csymbr) apply (simp add: bindE_bind_linearise) apply (rule ccorres_split_nothrow_case_sum) apply (ctac add: deriveCap_ccorres) apply ceqv apply (simp add: Collect_False del: Collect_const) apply csymbr apply (rule ccorres_split_nothrow_case_sum) apply (ctac add: checkValidIPCBuffer_ccorres) apply ceqv apply (simp add: Collect_False returnOk_bind
                              ccorres_invocationCatch_Inr
                         del: Collect_const) apply (ctac add: setThreadState_ccorres) apply (simp add: performInvocation_def) apply (csymbr, csymbr, csymbr) apply (ctac add: invokeTCB_ThreadControl_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (vcg exspec=invokeTCB_ThreadControl_modifies) apply simp apply (wp sts_invs_minor') apply (simp add: Collect_const_mem cintr_def intr_and_se_rel_def) apply (vcg exspec=setThreadState_modifies) apply (simp add: invocationCatch_def) apply (rule ccorres_split_throws, rule ccorres_return_C_errorE, simp+) apply vcg apply simp apply (wp checkValidIPCBuffer_ArchObject_wp) apply (simp add: intr_and_se_rel_def syscall_error_rel_def
                           exception_defs) apply (vcg exspec=checkValidIPCBuffer_modifies) apply (simp add: invocationCatch_def) apply (rule ccorres_split_throws) apply (rule ccorres_return_C_errorE, simp+)[1] apply vcg apply simp apply (wp | wp (once) hoare_drop_imps)+ apply (simp add: Collect_const_mem) apply (vcg exspec=deriveCap_modifies) apply simp apply (wp | wp (once) hoare_drop_imps)+ apply simp apply vcg apply wp apply simp apply (vcg exspec=getSyscallArg_modifies) apply (clarsimp simp: Collect_const_mem if_1_0_0 ct_in_state'_def
                        pred_tcb_at' cintr_def intr_and_se_rel_def
                        exception_defs syscall_error_rel_def) apply (rule conjI) apply (clarsimp simp: excaps_in_mem_def slotcap_in_mem_def) apply (rule conjI, clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (frule invs_mdb') apply (frule(2) tcb_at_capTCBPtr_CL) apply (auto simp: isCap_simps valid_cap'_def valid_mdb'_def valid_tcb_state'_def
                     valid_mdb_ctes_def no_0_def excaps_map_def
               elim: pred_tcb'_weakenE dest!: st_tcb_at_idle_thread'
              dest!: interpret_excaps_eq)[1] apply (clarsimp simp: option_to_0_def rf_sr_ksCurThread word_sless_def
            word_sle_def ThreadState_Restart_def mask_def) apply (rule conjI[rotated], clarsimp+) apply (drule interpret_excaps_eq[rule_format, where n=0], simp add: excaps_map_Nil) apply (simp add: mask_def "StrictC'_thread_state_defs" excaps_map_def) apply (clarsimp simp: ccap_rights_relation_def rightsFromWord_wordFromRights
                        cap_get_tag_isCap) apply (frule cap_get_tag_to_H, subst cap_get_tag_isCap, assumption, assumption) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeSetIPCBuffer args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeSetIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3410 buffera current_extra_caps slota length___unsigned_long cap) (?Q'3410 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | bufferPtr # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr bufferPtr);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q3410 buffera current_extra_caps slota length___unsigned_long cap s \<and> s' \<in> ?Q'3410 buffera current_extra_caps slota length___unsigned_long cap proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3425 buffera current_extra_caps slota length___unsigned_long cap) (?R''3427 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R3425 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> ?R''3427 buffera current_extra_caps slota length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3425 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) 0 cap) (?R''3427 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) 0 cap) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== 1;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R3425 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> ?R''3427 buffera current_extra_caps slota length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3425 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) 0 cap) (?G'3442 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) 0 cap) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF 1 \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R3425 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'3442 buffera current_extra_caps slota length___unsigned_long cap}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3425 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) 0 cap) (?G'3442 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) 0 cap) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> ?R3425 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'3442 buffera current_extra_caps slota length___unsigned_long cap}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3572 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) 0 cap) IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI {},UNIV
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> ?R'3572 buffera current_extra_caps slota length___unsigned_long cap}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (ret__int_' s \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>)))) \<and> (\<not> ret__int_' s \<noteq> 0 \<longrightarrow> True)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. ret__int_' s \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError (Inl Fault_H.syscall_error.TruncatedMessage) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>)))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R''3428 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3428 buffera current_extra_caps slota length___unsigned_long cap x xa}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?G'3614 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> ?G'3614 buffera current_extra_caps slota length___unsigned_long cap x xa}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?R'3741 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> ?R'3741 buffera current_extra_caps slota length___unsigned_long cap x xa \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 buffera current_extra_caps slota length___unsigned_long cap x21 x22) (?G'3745 buffera current_extra_caps slota length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>cptr_bufferPtr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'3745 buffera current_extra_caps slota length___unsigned_long cap x xa} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) (?G'3745 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'3745 buffera current_extra_caps slota length___unsigned_long cap x xa} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3426 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) (?G'3745 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (bufferCap, bufferSlot) # xa \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3426 buffera current_extra_caps slota length___unsigned_long cap x xa s)) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'3745 buffera current_extra_caps slota length___unsigned_long cap x xa} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4225 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) (?R''4228 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4224 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 a x21a x22a) (?R''4226 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (bufferCap, bufferSlot) \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R4225 buffera current_extra_caps slota length___unsigned_long cap x xa s) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R4224 buffera current_extra_caps slota length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R''4228 buffera current_extra_caps slota length___unsigned_long cap x xa} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''4226 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4225 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) (?R''4228 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4224 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 a x21a x22a) (?R''4226 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (bufferCap, bufferSlot) \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R4225 buffera current_extra_caps slota length___unsigned_long cap x xa s) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R4224 buffera current_extra_caps slota length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R''4228 buffera current_extra_caps slota length___unsigned_long cap x xa} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''4226 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4224 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 a x21a x22a) (?R''4226 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (bufferCap, bufferSlot) \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R4224 buffera current_extra_caps slota length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''4226 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R4224 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 a x21a x22a) (?R''4226 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (bufferCap, bufferSlot) \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF extraCaps = [] THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R4224 buffera current_extra_caps slota length___unsigned_long cap x xa s xb xc))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''4226 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4250 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) (?R'4248 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (bufferCap, bufferSlot) \<Rightarrow> doE ipcBuffer <- returnOk (VPtr x21);
bufferFrame <- if ipcBuffer = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap bufferSlot bufferCap;
checkValidIPCBuffer ipcBuffer bufferCap';
returnOk $ Just (bufferCap', bufferSlot)
odE;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot Nothing Nothing Nothing Nothing Nothing (Just (ipcBuffer, bufferFrame))
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R4250 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R'4248 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4250 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) (?R'4248 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF \<acute>cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,\<acute>cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R4250 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R'4248 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4270 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv) (?Q'4270 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>bufferSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>?Q4270 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> ?Q'4270 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s)}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4270 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv) (?G'4701 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(IF cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>?Q4270 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?G'4701 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s)}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A4957 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv) (?C'4956 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(IF cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. ?A4957 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?C'4956 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4961 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv) (?C'4956 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(IF cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P4961 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?C'4956 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?Q'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> ?Q'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G5175 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?G'5173 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF cptr_bufferPtr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> ?G5175 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'5173 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5179 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?S5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>bufferSlot :== NULL;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ?Q5179 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> ?S5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5179 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)) (?S5177 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (\<acute>bufferSlot :== NULL;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ?Q5179 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> ?S5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5179 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)) (?G'5199 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ?Q5179 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> ?G'5199 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv) (?Q'5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s)}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv) (?G'5430 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'5430 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv) (?G'5552 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> ?G'5552 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv) (?G'5650 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5379 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> ?G'5650 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rvb = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb) (?Q'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long) [SKIP] (if rvb = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rvb isCall)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) \<lbrace>?Q5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>, \<lbrace>?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap a\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rvb = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5723 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a 0 (fst x21a) bufferCap () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 []) (?Q'5723 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a 0 (fst x21a) bufferCap () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) \<lbrace>?Q5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>, \<lbrace>?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap a\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rvb = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5723 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a 0 (fst x21a) bufferCap () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 []) (?Q'5723 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a 0 (fst x21a) bufferCap () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) \<lbrace>?Q5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>, \<lbrace>?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap a\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap a\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R5725 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap a\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0; dc rv xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and (\<lambda>s. True \<and> True)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'5723 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (0, None))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and (\<lambda>s. True \<and> True)\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R5387 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> cte_wp_at' (\<lambda>_. True) slot b\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5387 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = 0 # x22; extraCaps = x21a # x22a; x21 = 0; ccap_relation (fst x21a) bufferCap; rva = fst x21a; cptr_bufferPtr = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5380 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap 0 x22 x21a x22a () 0 (fst x21a) bufferCap) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. bufferCap_' s) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (0, None) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (0, None)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (0, None) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (0, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (0, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5380 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0; ccap_relation rva bufferCap; rva = fst (extraCaps ! 0); cptr_bufferPtr \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) (?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva bufferCap) [SKIP] (doE bufferFrame <- if x21 = 0 then returnOk Nothing else doE bufferCap' <- global.deriveCap (snd x21a) (fst x21a);
checkValidIPCBuffer x21 bufferCap';
returnOk $ Just (bufferCap', snd x21a)
odE;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, bufferFrame)))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(cptr_bufferPtr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,cptr_bufferPtr,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)) (?T5177 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) [SKIP] (doE x <- global.deriveCap (snd x21a) (fst x21a);
xa <- checkValidIPCBuffer x21 x;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (x, snd x21a))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
lvar_nondet_init dc_ret_' dc_ret_'_update;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)) (?T5177 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) [SKIP] (doE x <- global.deriveCap (snd x21a) (fst x21a);
xa <- checkValidIPCBuffer x21 x;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (x, snd x21a))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (lvar_nondet_init e_' e_'_update;;
(lvar_nondet_init dc_ret_' dc_ret_'_update;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> ?T5177 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s))}}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)) (?G'5982 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) [SKIP] (doE x <- global.deriveCap (snd x21a) (fst x21a);
xa <- checkValidIPCBuffer x21 x;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (x, snd x21a))))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> ?G'5982 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5181 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)) (?G'5982 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) [SKIP] (global.deriveCap (snd x21a) (fst x21a) >>= case_sum (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) (\<lambda>rv. checkValidIPCBuffer x21 rv >>= case_sum (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) (\<lambda>rva. returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB))) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> ?R5181 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva s)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> ?G'5982 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?f'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap \<currency> ?r'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap) (liftxf (?es5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap) (?ef'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap) (?vf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap) (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap)) (?P6003 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)) (?P'5996 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) [SKIP] (global.deriveCap (snd x21a) (fst x21a)) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap) rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))) (?d'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv')
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ?r'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv (?vf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv'); ?ef'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv) (?Q'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') [SKIP] (do a <- checkValidIPCBuffer x21 rv;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rva \<Rightarrow> returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (?d'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv')
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ?ef'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err (?ef'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (?d'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv')
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>?Q5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. ?ef'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?r'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' (?vf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s)) \<longrightarrow> s \<in> ?Q'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s)) \<and> (\<forall>ft. ?ef'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?f'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (?ef'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s)) (?es5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (?xf'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s) (?es5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (?P6003 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> ?P'5996 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s) \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dc_ret_' rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))) (?d'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv')
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv) (?Q'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') [SKIP] (do a <- checkValidIPCBuffer x21 rv;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rva \<Rightarrow> returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (?d'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv')
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (?d'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv')
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>?Q5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' (dc_ret_' s)) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv) (?Q'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') [SKIP] (do a <- checkValidIPCBuffer x21 rv;
case a of Inl a \<Rightarrow> (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) a | Inr rva \<Rightarrow> returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>?Q5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' (dc_ret_' s)) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5994 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv) (?Q'5994 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv') [SKIP] (checkValidIPCBuffer x21 rv >>= case_sum (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) (\<lambda>rva. returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB)) (\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>?Q5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv' (dc_ret_' s)) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6315 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv) (?G'6322 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') [SKIP] (checkValidIPCBuffer x21 rv >>= case_sum (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) (\<lambda>rva. returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB)) (\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv');;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>?Q6315 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> ?G'6322 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?f'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' \<currency> ?r'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') (liftxf (?es6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') (?ef'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') (?vf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv')) (?P6575 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv) (?P'6568 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') [SKIP] (checkValidIPCBuffer x21 rv) (\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv'))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv') rv'a t t' (IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))) (?d'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a)
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb (?vf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a); ?ef'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb) (?Q'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb rv'a) [SKIP] (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a)
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?ef'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err (?ef'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (?d'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a)
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>?Q6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. ?ef'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?r'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a (?vf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s)) \<longrightarrow> s \<in> ?Q'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s)) \<and> (\<forall>ft. ?ef'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?f'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (?ef'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s)) (?es6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (?xf'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s) (?es6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. ?P6575 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> ?P'6568 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s) \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> e_' rv'a t t' (IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))) (?d'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a)
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb (K () rv'a); id rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb) (?Q'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb rv'a) [SKIP] (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a)
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (?d'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a)
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>?Q6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> ?Q'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb (K () rv'a); id rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb) (?Q'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rvb rv'a) [SKIP] (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>?Q6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> ?Q'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6566 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' ()) (?Q'6566 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>?Q6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> ?Q'6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a rvb xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6798 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a rvb) (?Q'6798 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a rvb xfdc) [SKIP] (doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q6798 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'6798 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a rvb (xfdc s)}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6798 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?Q'6798 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q6798 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'6798 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a rvb (xfdc s)}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6852 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?G'7114 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a))));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q6852 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> ?G'7114 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a rvb (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rvb = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb) (?Q'7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long) [SKIP] (if rvb = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rvb isCall)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7201 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) \<lbrace>?Q7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>, \<lbrace>?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7194 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv') {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (cptr_bufferPtr, Some (rv, snd x21a)))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R7201 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a a\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'7194 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a rvb (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rvb = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7193 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 []) (?Q'7193 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7201 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) \<lbrace>?Q7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>, \<lbrace>?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7194 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv') {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (cptr_bufferPtr, Some (rv, snd x21a)))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R7201 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a a\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'7194 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a rvb (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rvb = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7263 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 []) (?Q'7265 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7201 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) \<lbrace>?Q7263 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>, \<lbrace>?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7194 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv') {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. rvb = [] \<longrightarrow> s \<in> ?Q'7265 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 rvb (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (cptr_bufferPtr, Some (rv, snd x21a)))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R7201 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a a\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'7194 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a rvb (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err) (?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7201 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7194 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv') {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''7193 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (cptr_bufferPtr, Some (rv, snd x21a)))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R7201 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a a\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'7194 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a rvb (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R7201 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (x21, Some (rv, snd x21a)))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7194 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv') {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (cptr_bufferPtr, Some (rv, snd x21a)))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R7201 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a a\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'7194 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a rvb (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7194 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) \<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,0,0,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv') {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = \<^bsup>s\<^esup>ret__unsigned_long \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (cptr_bufferPtr, Some (rv, snd x21a)))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> ?R'7194 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a rvb (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot None None None None None (Some (cptr_bufferPtr, Some (rv, snd x21a)))) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = rv'a \<longrightarrow> rv'a = ret__unsigned_long_' t \<and> dc rva (K rva (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> rv'a \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6806 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rv b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned x21 msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = rv'a \<longrightarrow> rv'a = ret__unsigned_long_' t \<and> dc rva (K rva (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> rv'a \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R6806 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' a\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. bufferCap_'_update (\<lambda>x. deriveCap_ret_C.cap_C rv') (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer) (bufferSrcSlot_'_update (\<lambda>_. bufferSlot_' s) (bufferAddr_'_update (\<lambda>_. cptr_bufferPtr) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. slota) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None \<longrightarrow> \<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (cptr_bufferPtr, Some (rv, snd x21a))))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (cptr_bufferPtr, Some (rv, snd x21a)) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (cptr_bufferPtr, Some (rv, snd x21a)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = rv'a \<longrightarrow> rv'a = ret__unsigned_long_' t \<and> dc rva (K rva (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> rv'a \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rv a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6799 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rv a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'a. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv'a (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'6799 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' rv'a (e_' s)) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err) (?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rv a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv' (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err rv'a err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6566 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' err) (?Q''6566 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap rv rv' err rv'a err') [SKIP] (throwError (Inl err)) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'a);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,deriveCap_ret_C.cap_C rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rv a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)\<rbrace>, \<lbrace>?QE6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv' (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''6566 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' ft (e_' s) (errstate s))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err rv'a err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7444 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv' err rv'a err') return_C ret__unsigned_long_'_update (\<lambda>s. rv'a) {},UNIV
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rv a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv' (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (e_' s)) (errstate sa)} \<inter> ?R'7444 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv rv' ft (e_' s) (errstate s))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rv a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv' (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (e_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (10 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R6573 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv\<rbrace> checkValidIPCBuffer x21 rv \<lbrace>\<lambda>a b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rv b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned x21 msg_align_bits \<and> isArchObjectCap rv \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv' (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (e_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and ?R6573 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap a\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') {s. (\<forall>rv'. id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc rv' (K () (e_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>) \<and> (\<forall>ft. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (id (e_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (e_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and (\<lambda>b. True \<and> (isArchObjectCap a \<and> is_aligned cptr_bufferPtr msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap a \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0))\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6567 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(x21,deriveCap_ret_C.cap_C rv') \<lbrace>\<acute>e = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and (\<lambda>b. True \<and> (isArchObjectCap a \<and> is_aligned cptr_bufferPtr msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap a \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0))\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> ?R'6567 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap rv' (dc_ret_' s)}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err) (?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err') [SKIP] ((invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inl) err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and (\<lambda>b. True \<and> (isArchObjectCap a \<and> is_aligned cptr_bufferPtr msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap a \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0))\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5994 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap err) (?Q''5994 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a x21 (fst x21a) bufferCap err rv' err') [SKIP] (throwError (Inl err)) (return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv');;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(x21,\<acute>bufferCap);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,0,0,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,x21,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and (\<lambda>b. True \<and> (isArchObjectCap a \<and> is_aligned cptr_bufferPtr msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap a \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0))\<rbrace>, \<lbrace>?QE5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''5994 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap ft (dc_ret_' s) (errstate s))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7502 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap err) (?P'7505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap err rv' err') [SKIP] (throwError (Inl err)) (return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap err rv' err') return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv') {},UNIV
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and (\<lambda>b. True \<and> (isArchObjectCap a \<and> is_aligned cptr_bufferPtr msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap a \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0))\<rbrace>, \<lbrace>?QE7502 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?P'7505 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap ft (dc_ret_' s) (errstate s) \<inter> ?R'7503 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap ft (dc_ret_' s) (errstate s))}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; syscall_error_rel err (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x21 x22 x21a x22a (fst x21a) bufferCap err rv' err') return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv') {},UNIV
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and (\<lambda>b. True \<and> (isArchObjectCap a \<and> is_aligned cptr_bufferPtr msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap a \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> ?R'7503 buffera current_extra_caps slota length___unsigned_long cap x21 cptr_bufferPtr x22 x21a x22a rva bufferCap ft (dc_ret_' s) (errstate s))}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a. invs' and (\<lambda>b. True \<and> (isArchObjectCap a \<and> is_aligned cptr_bufferPtr msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> is_aligned cptr_bufferPtr msg_align_bits \<and> isArchObjectCap a \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6001 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a)\<rbrace> global.deriveCap (snd x21a) (fst x21a) \<lbrace>\<lambda>a b. invs' b \<and> (isArchObjectCap a \<and> is_aligned x21 msg_align_bits \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> snd x21a \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and ?R6001 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva) s)\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) {s. (\<forall>rv'. deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ccap_relation rv' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. cptr_bufferPtr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = cptr_bufferPtr\<rbrace> \<inter> \<lbrace>ccap_relation rv' \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}) \<and> (\<forall>ft. deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> syscall_error_rel ft (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel (Inl ft) (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rva a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)) s)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr rva bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21; ccap_relation (fst x21a) bufferCap; rva = fst x21a; x21 \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5995 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21 (fst x21a) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],bufferCap) \<lbrace>deriveCap_ret_C.status_C \<acute>dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C \<acute>dc_ret)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = 0) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rva a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)) s)\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (bufferCap_' s) \<longrightarrow> s \<in> {sa. rva = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> ?R'5995 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr rva (bufferCap_' s)}})}}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rva s. rva = fst (extraCaps ! 0) \<longrightarrow> (cptr_bufferPtr = 0 \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) s) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rva a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0)) s)\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}})}}}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21\<rbrakk> \<Longrightarrow> \<lbrace>?R4968 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a ()\<rbrace> getSlotCap (snd x21a) \<lbrace>\<lambda>rva s. rva = fst x21a \<longrightarrow> (x21 = 0 \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> (obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> cte_wp_at' (\<lambda>_. True) slot s) \<and> (x21 \<noteq> 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> (obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst x21a) s \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> snd x21a \<noteq> 0)\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}})}}}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R4968 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a a) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv cptr_bufferPtr) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. (cptr_bufferPtr = 0 \<longrightarrow> sa \<in> {s. bufferSlot_'_update (\<lambda>_. cte_Ptr cptr_bufferPtr) s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> cptr_bufferPtr = option_to_0 None \<and> cptr_bufferPtr = (case None of None \<Rightarrow> cptr_bufferPtr | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap v) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> (case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap va) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (option_to_0 (map_option snd None)) \<and> cptr_bufferPtr = option_to_0 (map_option fst (Some (cptr_bufferPtr, None))) \<and> cte_Ptr cptr_bufferPtr = cte_Ptr (case Some (cptr_bufferPtr, None) of None \<Rightarrow> cptr_bufferPtr | Some (ptr, None) \<Rightarrow> cptr_bufferPtr | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case Some (cptr_bufferPtr, None) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap (bufferCap_' s)) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer = (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else cptr_bufferPtr) || (if Some (cptr_bufferPtr, None) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else cptr_bufferPtr) || (if False then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else cptr_bufferPtr) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rv (K rv (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (s\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, struct_cap_C_eret_2_' := va, globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}) \<and> (cptr_bufferPtr \<noteq> 0 \<longrightarrow> sa \<in> {sa. \<forall>v. e_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. dc_ret_'_update (\<lambda>_. v) sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x21a)\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> \<acute>bufferSlot = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>}})}}}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (x21 = 0 \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> (x21 \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst x21a) a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a cptr_bufferPtr. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; cptr_bufferPtr = x21\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4965 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a () x21) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. ccap_relation (fst x21a) (bufferCap_' s) \<longrightarrow> (x21 = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> bufferSlot_'_update (\<lambda>_. NULL) s \<in> (if ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> (x21 \<noteq> 0 \<longrightarrow> (\<forall>v va. dc_ret_'_update (\<lambda>_. va) (e_'_update (\<lambda>_. v) s) \<in> (if excaprefs_C extraCaps'.[0] = cte_Ptr (snd x21a) then UNIV else {})) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> bufferSlot_' s = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (x21 = 0 \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> (x21 \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst x21a) a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'4965 buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a rv (cptr_bufferPtr_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R4278 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (x21 = 0 \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> (x21 \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst x21a) a \<and> cte_wp_at' (\<lambda>_. True) (snd x21a) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd x21a \<noteq> 0))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))\<rbrace>
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {sa. ccap_relation (fst x21a) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cptr_bufferPtr_' s = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> bufferSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) sa) \<in> (if ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> (cptr_bufferPtr_' s \<noteq> 0 \<longrightarrow> (\<forall>v va. dc_ret_'_update (\<lambda>_. va) (e_'_update (\<lambda>_. v) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) sa)) \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd x21a) then UNIV else {})) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> bufferSlot_' sa = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))} \<inter> \<lbrace>True\<rbrace>}}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R4278 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. cptr_bufferPtr_' s = args ! 0 \<longrightarrow> s \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {sa. ccap_relation (fst x21a) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cptr_bufferPtr_' s = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> bufferSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) sa) \<in> (if ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> (cptr_bufferPtr_' s \<noteq> 0 \<longrightarrow> (\<forall>v va. dc_ret_'_update (\<lambda>_. va) (e_'_update (\<lambda>_. v) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) sa)) \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd x21a) then UNIV else {})) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> bufferSlot_' sa = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))} \<inter> \<lbrace>True\<rbrace>}}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xa xb. extraCaps = xa # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (x = 0 \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> (x \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst xa) a \<and> cte_wp_at' (\<lambda>_. True) (snd xa) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd xa \<noteq> 0))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])))) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4271 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap x21 x22 x21a x22a) \<acute>cptr_bufferPtr :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. cptr_bufferPtr_' s = x21 \<longrightarrow> bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) s \<in> (if excaprefs_C extraCaps'.[0] = cte_Ptr (snd x21a) then UNIV else {}) \<and> (ccap_relation (fst x21a) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x21 = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> bufferSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) s) \<in> (if ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> (x21 \<noteq> 0 \<longrightarrow> (\<forall>v va. dc_ret_'_update (\<lambda>_. va) (e_'_update (\<lambda>_. v) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) (bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) s))) \<in> (if excaprefs_C extraCaps'.[0] = cte_Ptr (snd x21a) then UNIV else {})) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd x21a)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xa xb. extraCaps = xa # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (x = 0 \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> (x \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst xa) a \<and> cte_wp_at' (\<lambda>_. True) (snd xa) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd xa \<noteq> 0))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])))) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'4271 buffera current_extra_caps slota length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (1 subgoal):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xa xb. extraCaps = xa # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (x = 0 \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> (x \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst xa) a \<and> cte_wp_at' (\<lambda>_. True) (snd xa) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd xa \<noteq> 0))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])))) s))) \<and> s' \<in> {s. args = [] \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr> \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. extraCaps = xa # xb \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t = x \<longrightarrow> bufferSlot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) (cptr_bufferPtr_'_update (\<lambda>_. x) s) \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd xa) then UNIV else {}) \<and> (ccap_relation (fst xa) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> bufferSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) (cptr_bufferPtr_'_update (\<lambda>_. 0) s)) \<in> (if ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})) \<and> (x \<noteq> 0 \<longrightarrow> (\<forall>v va. dc_ret_'_update (\<lambda>_. va) (e_'_update (\<lambda>_. v) (bufferCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) (bufferSlot_'_update (\<lambda>_. excaprefs_C current_extra_caps.[0]) (cptr_bufferPtr_'_update (\<lambda>_. x) s)))) \<in> (if excaprefs_C current_extra_caps.[0] = cte_Ptr (snd xa) then UNIV else {})) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd xa)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))} \<inter> - \<lbrace>extraCaps = []\<rbrace>}}}} \<inter> - \<lbrace>(if length___unsigned_long = 0 then 1 else 0) \<noteq> 0\<rbrace>}}}} proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> (\<forall>a b xb. extraCaps = (a, b) # xb \<longrightarrow> sysargs_rel (x # xa) buffer s \<and> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (x = 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s) \<and> (x \<noteq> 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> b \<noteq> 0)) \<and> excaps_in_mem ((a, b) # xb) (ctes_of s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)) \<and> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>a b xb. extraCaps = (a, b) # xb \<longrightarrow> sysargs_rel (x # xa) buffer s \<and> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (x = 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s) \<and> (x \<noteq> 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> b \<noteq> 0)) \<and> excaps_in_mem ((a, b) # xb) (ctes_of s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b xb cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (x # xa) buffer s; args = x # xa; extraCaps = (cteCap cte, b) # xb; \<forall>x\<in>set xb. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; valid_cap' (cteCap cte) s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; ctes_of s b = Some cte; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) b s \<longrightarrow> (x = 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s) \<and> (x \<noteq> 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> b \<noteq> 0)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b xb cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (x # xa) buffer s; args = x # xa; extraCaps = (cteCap cte, b) # xb; \<forall>x\<in>set xb. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; valid_cap' (cteCap cte) s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; ctes_of s b = Some cte; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) b s \<longrightarrow> (x = 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s) \<and> (x \<noteq> 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> b \<noteq> 0)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b xb cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (x # xa) buffer s; args = x # xa; extraCaps = (cteCap cte, b) # xb; \<forall>x\<in>set xb. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; valid_cap' (cteCap cte) s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; ctes_of s b = Some cte; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; valid_mdb' s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) b s \<longrightarrow> (x = 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s) \<and> (x \<noteq> 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> b \<noteq> 0)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' x xa b xb cte. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((cteCap cte, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (x # xa) buffer s; args = x # xa; extraCaps = (cteCap cte, b) # xb; \<forall>x\<in>set xb. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; valid_cap' (cteCap cte) s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; ctes_of s b = Some cte; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; valid_mdb' s; tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) b s \<longrightarrow> (x = 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s) \<and> (x \<noteq> 0 \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> b \<noteq> 0)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' x xa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel (x # xa) buffer s; args = x # xa\<rbrakk> \<Longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (x = 0 \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (x \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> length___unsigned_long \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem ((a, b) # xb) (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (ret__unsigned_long_' t = 0 \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem ((a, b) # xb) (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = excaps_map ((a, b) # xb) ! 0 \<and> (length (excaps_map ((a, b) # xb)) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (excaps_map ((a, b) # xb))] = NULL)\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (ret__unsigned_long_' t = 0 \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem ((a, b) # xb) (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (length xb < 2 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (length xb)] = NULL)\<rbrakk> \<Longrightarrow> ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))) \<longrightarrow> (ret__unsigned_long_' t = 0 \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem ((a, b) # xb) (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; length xb < 2 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (length xb)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (ret__unsigned_long_' t = 0 \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>unat length___unsigned_long = Suc (length xa); ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; excaps_in_mem ((a, b) # xb) (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; length xb < 2 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (length xb)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))\<rbrakk> \<Longrightarrow> (ret__unsigned_long_' t = 0 \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)) \<and> (ret__unsigned_long_' t \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<exists>rv'. ccap_relation rv' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp))) proof (prove)
goal:
No subgoals!