theory Tcb_C

lemma decodeSetMCPriority_ccorres:
  "\<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps\<rbrakk> \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread)
              and ct_active' and sch_act_simple
              and (excaps_in_mem extraCaps \<circ> ctes_of)
              and (\<lambda>s. \<forall>rf \<in> zobj_refs' cp. ex_nonz_cap_to' rf s)
              and valid_cap' cp and K (isThreadCap cp)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             ex_cte_cap_wp_to' isCNodeCap (snd v) s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             s \<turnstile>' fst v \<and> cte_at' (snd v) s)
              and sysargs_rel args buffer)
       (UNIV
            \<inter> {s. ccap_relation cp (cap_' s)}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (decodeSetMCPriority args cp extraCaps
            >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeSetMCPriority_'proc)" supply Collect_const[simp del] apply (cinit' lift: cap_' length___unsigned_long_' current_extra_caps_' buffer_' simp: decodeSetMCPriority_def) apply (simp cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule ccorres_rhs_assoc2) apply (rule_tac xf'=ret__int_' and R'=UNIV and R=\<top> and
                   val="from_bool (length args = 0 \<or> length extraCaps = 0)" in
                   ccorres_symb_exec_r_known_rv) apply vcg apply (force simp: interpret_excaps_test_null excaps_map_def from_bool_def unat_eq_0
                   split: bool.splits) apply ceqv apply clarsimp apply wpc 
     (* Case args = [] *)
      apply (rule ccorres_cond_true_seq) apply (clarsimp simp: throwError_bind invocationCatch_def) apply (rule ccorres_rhs_assoc) apply (ccorres_rewrite) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) 
    (* Case args is Cons *)
     apply wpc 
     (* Sub-case extraCaps = [] *)
      apply (rule ccorres_cond_true_seq) apply (clarsimp simp: throwError_bind invocationCatch_def) apply (rule ccorres_rhs_assoc) apply (ccorres_rewrite) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) 
    (* Main case where args and extraCaps are both Cons *)
     apply (rule ccorres_cond_false_seq) apply (simp add: split_def) apply (rule ccorres_add_return,
           ctac add: getSyscallArg_ccorres_foo'[where args=args and n=0 and buffer=buffer]) apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply (rule ccorres_move_c_guard_cte) apply ctac apply csymbr apply (simp add: cap_get_tag_isCap cong: call_ignore_cong) apply (rule ccorres_assert2) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_rhs_assoc) apply ccorres_rewrite apply (clarsimp simp: not_isThreadCap_case throwError_bind invocationCatch_def
                         simp del: id_simps) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (clarsimp simp: isCap_simps) apply csymbr apply csymbr 
        (* Pre-conditions need to depend on the inner value of the thread cap *)
         apply (rule ccorres_inst[where P="Q (capTCBPtr (fst (extraCaps ! 0)))" and
                                       P'="Q' (capTCBPtr (fst (extraCaps ! 0)))" for Q Q']) apply (clarsimp simp: capTCBPtr_eq isCap_simps invocationCatch_use_injection_handler
                              injection_bindE[OF refl refl] bindE_assoc injection_handler_returnOk) apply (ctac add: ccorres_injection_handler_csum1[OF checkPrio_ccorres]) apply (rule_tac P="hd args \<le> ucast (max_word :: priority)"
                           in ccorres_cross_over_guard_no_st) apply (simp add: ccorres_invocationCatch_Inr performInvocation_def) apply ccorres_rewrite apply (ctac add: setThreadState_ccorres) apply (simp add: invocationCatch_def) apply ccorres_rewrite apply csymbr apply csymbr apply csymbr apply csymbr apply (ctac (no_vcg) add: invokeTCB_ThreadControl_ccorres) apply clarsimp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE; simp) apply (rule ccorres_return_C_errorE; simp) apply wp apply (wpsimp wp: sts_invs_minor') apply simp apply (vcg exspec=setThreadState_modifies) apply simp apply (rename_tac err_c) apply (rule_tac P'="{s. err_c = errstate s}" in ccorres_from_vcg_split_throws) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def intr_and_se_rel_def syscall_error_rel_def) apply simp apply (rule injection_handler_wp) apply (rule checkPrio_wp[simplified validE_R_def]) apply vcg apply (wp | simp | wpc | wp (once) hoare_drop_imps)+ apply vcg apply wp apply (vcg exspec=getSyscallArg_modifies) apply (clarsimp simp: EXCEPTION_SYSCALL_ERROR_def EXCEPTION_NONE_def) apply vcg apply clarsimp apply (rule conjI) apply (clarsimp simp: ct_in_state'_def pred_tcb_at'
                         valid_cap'_def isCap_simps) apply (rule conjI, clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (clarsimp simp: maxPriority_def numPriorities_def FF_eq_minus_1) apply (rule conjI, clarsimp) apply (frule mcpriority_tcb_at'_prio_bounded, simp) apply (auto simp: valid_tcb_state'_def le_ucast_ucast_le
                elim!: obj_at'_weakenE pred_tcb'_weakenE
                dest!: st_tcb_at_idle_thread')[1] apply (clarsimp simp: interpret_excaps_eq excaps_map_def) apply (simp add: StrictC'_thread_state_defs mask_eq_iff_w2p word_size option_to_0_def) apply (frule rf_sr_ksCurThread) apply (simp only: cap_get_tag_isCap[symmetric], drule(1) cap_get_tag_to_H) apply (clarsimp simp: valid_cap'_def capAligned_def interpret_excaps_eq excaps_map_def) apply (intro conjI impI allI) apply (clarsimp simp: unat_eq_0 le_max_word_ucast_id cap_get_tag_isCap_unfolded_H_cap isCap_simps)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeSetMCPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeSetMCPriority_'proc) proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and K (isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeSetMCPriority args cp extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeSetMCPriority_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2721 buffera current_extra_caps length___unsigned_long cap) (?Q'2721 buffera current_extra_caps length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 1) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) 0,\<acute>newMcp,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),\<acute>struct_cap_C_eret_2,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) 0,\<acute>struct_cap_C_eret_3,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2721 buffera current_extra_caps length___unsigned_long cap s \<and> s' \<in> ?Q'2721 buffera current_extra_caps length___unsigned_long cap proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2721 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?Q'2721 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2721 buffera current_extra_caps length___unsigned_long cap s \<and> s' \<in> ?Q'2721 buffera current_extra_caps length___unsigned_long cap proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2721 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?Q'2721 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2721 buffera current_extra_caps length___unsigned_long cap s \<and> s' \<in> ?Q'2721 buffera current_extra_caps length___unsigned_long cap proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. True \<and> (s, s') \<in> rf_sr}) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__int = from_bool (length args = 0 \<or> length extraCaps = 0)\<rbrace>)
 2. \<And>buffera current_extra_caps length___unsigned_long cap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?y'2737 buffera current_extra_caps length___unsigned_long cap rv')
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2742 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?Q2737 buffera current_extra_caps length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'2737 buffera current_extra_caps length___unsigned_long cap (from_bool (length args = 0 \<or> length extraCaps = 0)))
 4. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> ?Q2737 buffera current_extra_caps length___unsigned_long cap}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (?P2742 buffera current_extra_caps length___unsigned_long cap and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long cap s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. True \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. ((if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (s, sa\<lparr>ret__int_' := if length___unsigned_long = 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if length___unsigned_long = 0 then 1 else 0) = from_bool (length args = 0 \<or> length extraCaps = 0)) \<and> (\<not> (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (s, sa\<lparr>ret__int_' := if excaprefs_C extraCaps'.[0] = NULL then 1 else 0\<rparr>) \<in> rf_sr \<and> (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) = from_bool (length args = 0 \<or> length extraCaps = 0))}
 2. \<And>buffera current_extra_caps length___unsigned_long cap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?y'2737 buffera current_extra_caps length___unsigned_long cap rv')
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2742 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?Q2737 buffera current_extra_caps length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'2737 buffera current_extra_caps length___unsigned_long cap (from_bool (length args = 0 \<or> length extraCaps = 0)))
 4. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> ?Q2737 buffera current_extra_caps length___unsigned_long cap}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (?P2742 buffera current_extra_caps length___unsigned_long cap and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?y'2737 buffera current_extra_caps length___unsigned_long cap rv')
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2742 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?Q2737 buffera current_extra_caps length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?y'2737 buffera current_extra_caps length___unsigned_long cap (from_bool (length args = 0 \<or> length extraCaps = 0)))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> ?Q2737 buffera current_extra_caps length___unsigned_long cap}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (?P2742 buffera current_extra_caps length___unsigned_long cap and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2742 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?Q2737 buffera current_extra_caps length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF from_bool (length args = 0 \<or> length extraCaps = 0) \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> ?Q2737 buffera current_extra_caps length___unsigned_long cap}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (?P2742 buffera current_extra_caps length___unsigned_long cap and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2742 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?Q2737 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | newMCP # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (authCap, xa) # xb \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio newMCP authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral newMCP, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> ?Q2737 buffera current_extra_caps length___unsigned_long cap}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (?P2742 buffera current_extra_caps length___unsigned_long cap and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3265 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?R''3267 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> ?R''3267 buffera current_extra_caps length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> ?R3265 buffera current_extra_caps length___unsigned_long cap a) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3265 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?R''3267 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> ?R''3267 buffera current_extra_caps length___unsigned_long cap} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> ?R3265 buffera current_extra_caps length___unsigned_long cap a) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3265 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?R'3271 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> ?R'3271 buffera current_extra_caps length___unsigned_long cap \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> ?R3265 buffera current_extra_caps length___unsigned_long cap a) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3265 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?R'3271 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> ?R'3271 buffera current_extra_caps length___unsigned_long cap \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> ?R3265 buffera current_extra_caps length___unsigned_long cap a) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3265 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?R'3271 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
(return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> ?R'3271 buffera current_extra_caps length___unsigned_long cap \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> ?R3265 buffera current_extra_caps length___unsigned_long cap a) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3265 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) (?R'3271 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> ?R'3271 buffera current_extra_caps length___unsigned_long cap \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> ?R3265 buffera current_extra_caps length___unsigned_long cap a) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = 0; ccap_relation cp cap; args = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3264 (option_to_ptr buffer) extraCaps' length___unsigned_long cap a x21 x22) (?R''3266 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] ((case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | aa # xb \<Rightarrow> case aa of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> ?R''3266 buffera current_extra_caps length___unsigned_long cap x xa}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> ?R3264 buffera current_extra_caps length___unsigned_long cap a x xa)) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3338 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) (?R''3340 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R''3340 buffera current_extra_caps length___unsigned_long cap x xa} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R3338 buffera current_extra_caps length___unsigned_long cap x xa a) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3338 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) (?R''3340 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R''3340 buffera current_extra_caps length___unsigned_long cap x xa} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R3338 buffera current_extra_caps length___unsigned_long cap x xa a) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3338 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) (?R'3344 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] (throw Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R'3344 buffera current_extra_caps length___unsigned_long cap x xa \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R3338 buffera current_extra_caps length___unsigned_long cap x xa a) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3338 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) (?R'3344 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R'3344 buffera current_extra_caps length___unsigned_long cap x xa \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R3338 buffera current_extra_caps length___unsigned_long cap x xa a) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3338 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) (?R'3344 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
(return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R'3344 buffera current_extra_caps length___unsigned_long cap x xa \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R3338 buffera current_extra_caps length___unsigned_long cap x xa a) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3338 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) (?R'3344 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> ?R'3344 buffera current_extra_caps length___unsigned_long cap x xa \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> ?R3338 buffera current_extra_caps length___unsigned_long cap x xa a) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R3337 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 a x21a x22a) (?R''3339 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args = [] \<or> extraCaps = [] THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R''3339 buffera current_extra_caps length___unsigned_long cap x xa xb xc}}}}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3337 buffera current_extra_caps length___unsigned_long cap x xa a xb xc))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3400 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) (?R'3399 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] ((case x21a of (authCap, xa) \<Rightarrow> doE authTCB <- case authCap of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
checkPrio x21 authTCB;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) 0 Nothing (Just $ (fromIntegral x21, authTCB)) Nothing Nothing Nothing Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R'3399 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3400 buffera current_extra_caps length___unsigned_long cap x xa xb xc a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3400 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) (?R'3399 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(\<acute>newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,\<acute>newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> ?R'3399 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> ?R3400 buffera current_extra_caps length___unsigned_long cap x xa xb xc a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3416 length___unsigned_long cap x21 x22 x21a x22a rv) (?Q'3416 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>?Q3416 length___unsigned_long cap x21 x22 x21a x22a\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> ?Q'3416 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3858 length___unsigned_long cap x21 x22 x21a x22a rv) (?Q'3416 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P3858 length___unsigned_long cap x21 x22 x21a x22a a s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> ?Q'3416 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3861 length___unsigned_long cap x21 x22 x21a x22a rv) (?C'3860 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(\<acute>authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A3861 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> ?C'3860 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva authCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0); ccap_relation rva authCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva) (?Q'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva authCap) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(authCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> ?Q'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s)}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0); ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva) (?G'4260 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva authCap ret__unsigned) [SKIP] (do _ <- assert (rva = fst (extraCaps ! 0));
doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4260 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3866 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?G'4260 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (do _ <- assert (rva = fst x21a);
doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF \<not> isThreadCap rva THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4260 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G4422 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?G'4423 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF \<not> isThreadCap rva THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> ?G4422 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> ?G'4423 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4431 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?S4434 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?T4432 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> ?Q4431 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?S4434 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4432 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v)}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4431 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?S4434 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
(return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?T4432 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> ?Q4431 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?S4434 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4432 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v)}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4431 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?S4434 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap x \<Rightarrow> returnOk x | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?T4432 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> ?Q4431 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?S4434 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4432 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v)}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 a b x22a authCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((a, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (a, b) # x22a; ccap_relation a authCap; \<not> isThreadCap a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4431 length___unsigned_long cap x21 x22 (a, b) x22a () x21 a) (?S4434 length___unsigned_long cap x21 x22 (a, b) x22a () x21 a authCap (cap_get_tag authCap)) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidCapability (Suc 0)))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 1));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?T4432 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> ?Q4431 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> ?S4434 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4432 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v)}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 a b x22a authCap err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((a, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (a, b) # x22a; ccap_relation a authCap; \<not> isThreadCap a\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidCapNumber_C_update (\<lambda>_. 1) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) err')) ft' = Some (Fault_H.syscall_error.InvalidCapability (Suc 0))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?T4432 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4432 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v)}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp rva authCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21; ccap_relation rva authCap; ret__unsigned = cap_get_tag authCap; rva = fst x21a; \<not> \<not> isThreadCap rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 x21a x22a () x21 rva) (?T4432 length___unsigned_long cap x21 x22 x21a x22a () x21 rva authCap (cap_get_tag authCap)) [SKIP] (doE authTCB <- case fst x21a of capability.ThreadCap a \<Rightarrow> returnOk a | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
a <- checkPrio x21 authTCB;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, authTCB)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(newMcp,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,newMcp,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4432 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v)}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0)) (?T4432 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap)) [SKIP] (doE a <- checkPrio x21 v0;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(authCap);;
(\<acute>authTCB :== tcb_Ptr \<acute>ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(x21,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> ?T4432 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v)}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift authCap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0)) (?G'4559 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) ret__unsigned) [SKIP] (doE a <- checkPrio x21 v0;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>authTCB :== tcb_Ptr ret__unsigned;;
(\<acute>status :== CALL checkPrio_'proc(x21,\<acute>authTCB);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'4559 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift authCap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0)) (?G'4746 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) ret__unsigned) [SKIP] (doE a <- checkPrio x21 v0;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>status :== CALL checkPrio_'proc(x21,tcb_Ptr ret__unsigned);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4746 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift authCap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4430 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0)) (?G'4746 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) ret__unsigned) [SKIP] (doE a <- checkPrio x21 v0;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>status :== CALL checkPrio_'proc(x21,tcb_Ptr ret__unsigned);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4746 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift authCap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5007 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))) (?Q'5006 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0)))) [SKIP] (doE a <- checkPrio x21 v0;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>status :== CALL checkPrio_'proc(x21,tcb_Ptr ret__unsigned);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4746 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?Q'5006 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?G'4746 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap)
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?Q5007 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0))) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R4430 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5007 length___unsigned_long cap x21 x22 b x22a v0 v0) (?Q'5006 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) [SKIP] (doE x <- injection_handler Inl (checkPrio x21 v0);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None))
odE) (\<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> ?R4430 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> ?G'4746 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?Q'5006 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?G'4746 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap)
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?Q5007 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0))) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R4430 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 rv status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5020 length___unsigned_long cap x21 x22 b x22a authCap v0 rv) (?Q'5020 length___unsigned_long cap x21 x22 b x22a authCap v0 rv status) [SKIP] (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None))) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>?Q5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> ?Q'5020 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 rv status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'5343 length___unsigned_long cap x21 x22 b x22a authCap v0 rv) (?Q5340 length___unsigned_long cap x21 x22 b x22a authCap v0 rv status) [SKIP] (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None))) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ?P'5343 length___unsigned_long cap x21 x22 b x22a authCap v0 a\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> ?Q5340 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'5343 length___unsigned_long cap x21 x22 b x22a authCap v0 ()) (?Q5340 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (IF False THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ?P'5343 length___unsigned_long cap x21 x22 b x22a authCap v0 a\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> ?Q5340 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'5343 length___unsigned_long cap x21 x22 b x22a authCap v0 ()) (?Q5340 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ?P'5343 length___unsigned_long cap x21 x22 b x22a authCap v0 a\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> ?Q5340 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv) (?Q'5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s)}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?Q'5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s)}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?Q'5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s)}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?G'5826 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'5826 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?G'6014 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,NULL,0,x21,0,ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> ?G'6014 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?G'6170 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,NULL,0,x21,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> ?G'6170 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()) (?G'6294 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) () xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,NULL,0,x21,0,ret__struct_cap_C,NULL,struct_cap_C_eret_2,NULL,0,struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q5604 length___unsigned_long cap x21 x22 b x22a authCap v0 status\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {sa. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> ?G'6294 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rv = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 rv) (?Q'6399 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 rv ret__unsigned_long) [SKIP] (if rv = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rv isCall)) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err) (?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) \<lbrace>?Q6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3\<rbrace>, \<lbrace>?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 status a\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {sa. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. vc) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. x21) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. NULL) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = NULL\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case Some (UCAST(32 \<rightarrow> 8) x21, v0) of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if Some (UCAST(32 \<rightarrow> 8) x21, v0) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = status \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'6398 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc t rva)) \<and> (id (ret__unsigned_long_' t) \<noteq> status \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc t err))}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 7. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 t rv. ?Q'6399 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?Q'6398 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 t err. ?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6379 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 []) (?Q'6399 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err) (?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) \<lbrace>?Q6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3\<rbrace>, \<lbrace>?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 status a\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {sa. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. vc) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. x21) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. NULL) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = NULL\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case Some (UCAST(32 \<rightarrow> 8) x21, v0) of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if Some (UCAST(32 \<rightarrow> 8) x21, v0) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = status \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'6398 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc t rva)) \<and> (id (ret__unsigned_long_' t) \<noteq> status \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc t err))}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 7. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 t rv. ?Q'6399 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?Q'6398 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 t err. ?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6379 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 []) (?Q'6399 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err) (?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) \<lbrace>?Q6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3\<rbrace>, \<lbrace>?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 status a\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {sa. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. vc) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. x21) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. NULL) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = NULL\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case Some (UCAST(32 \<rightarrow> 8) x21, v0) of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if Some (UCAST(32 \<rightarrow> 8) x21, v0) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = status \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'6398 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc t rva)) \<and> (id (ret__unsigned_long_' t) \<noteq> status \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc t err))}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 7. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 t rv. ?Q'6399 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?Q'6398 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 t err. ?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (13 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err) (?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE6379 length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 status a\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {sa. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {sa. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. vc) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. x21) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. NULL) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = NULL\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case Some (UCAST(32 \<rightarrow> 8) x21, v0) of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if Some (UCAST(32 \<rightarrow> 8) x21, v0) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = status \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> status \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 status rv (xfdc s) v va vb vc t err))}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 7. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 t err. ?Q''6397 length___unsigned_long cap x21 x22 b x22a authCap v0 xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?Q''6396 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status xfdc ret__unsigned ret__struct_cap_C struct_cap_C_eret_2 struct_cap_C_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_2 = SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag struct_cap_C_eret_3 = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) ()\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R6391 length___unsigned_long cap x21 x22 b x22a authCap v0 status a\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. vc) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. x21) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. NULL) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = NULL\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case Some (UCAST(32 \<rightarrow> 8) x21, v0) of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if Some (UCAST(32 \<rightarrow> 8) x21, v0) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = status \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> status \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> status \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (11 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) 0 None (Some (UCAST(32 \<rightarrow> 8) x21, v0)) None None None None) and (\<lambda>_. (None = None) = (None = None) \<and> (None = None) = (None = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. vc) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. x21) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. NULL) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = NULL\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case Some (UCAST(32 \<rightarrow> 8) x21, v0) of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if Some (UCAST(32 \<rightarrow> 8) x21, v0) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = status \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> status \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> status \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R5612 length___unsigned_long cap x21 x22 b x22a authCap v0 a)\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. \<forall>vb. cap_get_tag vb = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_2_' := vb\<rparr> \<in> {s. \<forall>vc. cap_get_tag vc = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>struct_cap_C_eret_3_' := vc\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. vc) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. NULL) (vRoot_newCap_'_update (\<lambda>_. vb) (cRoot_srcSlot_'_update (\<lambda>_. NULL) (cRoot_newCap_'_update (\<lambda>_. va) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. x21) (faultep_'_update (\<lambda>_. 0) (slot_'_update (\<lambda>_. NULL) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>None \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = NULL\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 None\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case Some (UCAST(32 \<rightarrow> 8) x21, v0) of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some a \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) a)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd None))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if Some (UCAST(32 \<rightarrow> 8) x21, v0) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = status \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> status \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> status \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'5605 length___unsigned_long cap x21 x22 b x22a authCap v0 rv (status_' s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' status) [SKIP] (throwError err) (IF True THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' err_c. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' err_c\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err) (?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' err_c) [SKIP] (throwError err) (IF True THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_2 :== CALL cap_null_cap_new_'proc();;
(\<acute>struct_cap_C_eret_3 :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,NULL,0,x21,0,\<acute>ret__struct_cap_C,NULL,\<acute>struct_cap_C_eret_2,NULL,0,\<acute>struct_cap_C_eret_3,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' err_c. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' err_c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6568 length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' err_c) IF True THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI {},UNIV
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' err_c \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' err_c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. ?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err \<sigma> \<and> s \<in> {s. err_c = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} IF True THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> ?R'6568 length___unsigned_long cap x21 x22 b x22a authCap v0 err (status_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 10. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' err_c \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' err_c\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. ?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err \<sigma> \<and> s \<in> {s. err_c = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} IF True THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0 err rv' err_c \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' err_c\<rbrakk> \<Longrightarrow> {s. ?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 err \<sigma> \<and> s \<in> {s. err_c = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (True \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := rv', global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := rv', global_exn_var_' := Return\<rparr>)))) \<and> (\<not> True \<longrightarrow> True)}
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 9. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a. K (hd args \<le> UCAST(8 \<rightarrow> 32) (- 1)) and ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 a))\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> injection_handler Inl (checkPrio x21 v0) \<lbrace>\<lambda>a b. x21 \<le> mask 8 \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 b\<rbrace>, \<lbrace>?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5031 length___unsigned_long cap x21 x22 b x22a v0 v0\<rbrace> checkPrio x21 v0 \<lbrace>\<lambda>a b. x21 \<le> mask 8 \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) v0 b\<rbrace>, \<lbrace>\<lambda>ft. ?QE5020 length___unsigned_long cap x21 x22 b x22a authCap v0 (Inl ft)\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and ?R5035 length___unsigned_long cap x21 x22 x21a x22a rv newMcp a) b)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 8. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5035 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a v0. ?R5031 length___unsigned_long cap x21 x22 b x22a v0 (capTCBPtr (fst (extraCaps ! 0)))
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 b x22a authCap v0. \<lbrakk>interpret_excaps extraCaps' = excaps_map ((capability.ThreadCap v0, b) # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = (capability.ThreadCap v0, b) # x22a; ccap_relation (capability.ThreadCap v0) authCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 (ptr_val (tcb_ptr_to_ctcb_ptr v0)) v0) \<acute>status :== CALL checkPrio_'proc(x21,tcb_ptr_to_ctcb_ptr v0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s'. hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> s' \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap\<rbrace>})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and (\<lambda>a. mcpriority_tcb_at' (\<lambda>mcp. newMcp \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst (extraCaps ! 0))) a \<longrightarrow> newMcp \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) newMcp \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) newMcp)) (capTCBPtr (fst (extraCaps ! 0))) a)) b)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. authTCB_'_update (\<lambda>_. tcb_Ptr va) sa \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> ?R'5023 length___unsigned_long cap x21 x22 x21a x22a rv newMcp rva (authCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 7. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV
flex-flex pairs:
\<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0. ?R'5023 length___unsigned_long cap x21 x22 (capability.ThreadCap v0, b) x22a () x21 (capability.ThreadCap v0) authCap (cap_get_tag authCap) \<equiv>\<^sup>? \<lambda>length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned. ?R'5021 length___unsigned_long cap x21 x22 b x22a authCap v0 ret__unsigned (capTCBPtr (fst (extraCaps ! 0))) proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R3869 length___unsigned_long cap x21 x22 x21a x22a rv\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. a = fst x21a \<longrightarrow> (\<not> isThreadCap a \<longrightarrow> True) \<and> (\<not> \<not> isThreadCap a \<longrightarrow> (tcb_at' (capTCBPtr (fst (extraCaps ! 0))) and (\<lambda>a. mcpriority_tcb_at' (\<lambda>mcp. newMcp \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst (extraCaps ! 0))) a \<longrightarrow> newMcp \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) newMcp \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) newMcp)) (capTCBPtr (fst (extraCaps ! 0))) a)) b)\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a rv newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = UCAST(32 \<rightarrow> 32) (args ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv newMcp) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (authCap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. rva = fst x21a \<longrightarrow> sa \<in> {sa. (\<not> isThreadCap rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isThreadCap rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. authTCB_'_update (\<lambda>_. tcb_Ptr v) s \<in> {s. auth_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))) (prio_'_update (\<lambda>_. newMcp) s) \<in> UNIV \<inter> \<lbrace>\<acute>prio = newMcp\<rbrace> \<inter> \<lbrace>\<acute>auth = tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rbrace>} \<inter> {s. \<forall>v. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0))) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rightarrow>[''tcbMCP_C''])) < newMcp \<longrightarrow> id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) \<longrightarrow> hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> newMcp = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) newMcp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (\<not> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst (extraCaps ! 0)))\<rightarrow>[''tcbMCP_C''])) < newMcp \<longrightarrow> id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<longrightarrow> hd args \<le> UCAST(8 \<rightarrow> 32) (- 1) \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> newMcp = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) newMcp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. authCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}}}
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R3869 length___unsigned_long cap x21 x22 x21a x22a a and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 4. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 5. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 6. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a newMcp. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a; newMcp = x21\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3866 length___unsigned_long cap x21 x22 x21a x22a () x21) \<acute>authCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. ccap_relation (fst x21a) (authCap_' s) \<longrightarrow> isThreadCap (fst x21a) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a)) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a))\<rightarrow>[''tcbMCP_C''])) < x21 \<longrightarrow> EXCEPTION_SYSCALL_ERROR = EXCEPTION_NONE \<longrightarrow> x21 \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (\<not> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a))\<rightarrow>[''tcbMCP_C''])) < x21 \<longrightarrow> x21 \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x21 = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x21)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> cap_get_tag (authCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isThreadCap (fst x21a) \<longrightarrow> tcb_at' (capTCBPtr (fst x21a)) a \<and> (mcpriority_tcb_at' (\<lambda>mcp. x21 \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst x21a)) a \<longrightarrow> x21 \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) (capTCBPtr (fst x21a)) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'3866 length___unsigned_long cap x21 x22 x21a x22a rv (newMcp_' s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 5. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<lbrace>?R3422 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a\<rbrace> return () \<lbrace>\<lambda>a. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isThreadCap (fst x21a) \<longrightarrow> tcb_at' (capTCBPtr (fst x21a)) a \<and> (mcpriority_tcb_at' (\<lambda>mcp. x21 \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst x21a)) a \<longrightarrow> x21 \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x21 \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x21)) (capTCBPtr (fst x21a)) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 2. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {sa. ccap_relation (fst x21a) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst x21a) \<longrightarrow> (sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a)) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a))\<rightarrow>[''tcbMCP_C''])) < newMcp_' s \<longrightarrow> EXCEPTION_SYSCALL_ERROR = EXCEPTION_NONE \<longrightarrow> newMcp_' s \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> newMcp_' s = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (newMcp_' s))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (\<not> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a))\<rightarrow>[''tcbMCP_C''])) < newMcp_' s \<longrightarrow> newMcp_' s \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> newMcp_' s = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (newMcp_' s))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 4. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xb xc. extraCaps = xb # xc \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R3422 buffera current_extra_caps length___unsigned_long cap x xa xb xc) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap x21 x22 x21a x22a. \<lbrakk>interpret_excaps extraCaps' = excaps_map (x21a # x22a); unat length___unsigned_long = Suc (length x22); ccap_relation cp cap; args = x21 # x22; extraCaps = x21a # x22a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3417 (option_to_ptr buffer) extraCaps' length___unsigned_long cap x21 x22 x21a x22a) \<acute>newMcp :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. newMcp_' s = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {sa. ccap_relation (fst x21a) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst x21a) \<longrightarrow> (sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a)) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a))\<rightarrow>[''tcbMCP_C''])) < newMcp_' s \<longrightarrow> EXCEPTION_SYSCALL_ERROR = EXCEPTION_NONE \<longrightarrow> newMcp_' s \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> newMcp_' s = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (newMcp_' s))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (\<not> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x21a))\<rightarrow>[''tcbMCP_C''])) < newMcp_' s \<longrightarrow> newMcp_' s \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> newMcp_' s = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (newMcp_' s))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. extraCaps = xb # xc \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'3417 buffera current_extra_caps length___unsigned_long cap x xa xb xc \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 3. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xa xb. extraCaps = xa # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isThreadCap (fst xa) \<longrightarrow> tcb_at' (capTCBPtr (fst xa)) a \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst xa)) a \<longrightarrow> x \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr (fst xa)) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 buffera current_extra_caps length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. \<forall>rv. ret__int_' s = from_bool (length args = 0 \<or> length extraCaps = 0) \<longrightarrow> s \<in> {s. args = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. args = x # xa \<longrightarrow> s \<in> {s. extraCaps = [] \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>args = [] \<or> extraCaps = []\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. extraCaps = x # xa \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> {s. \<forall>t. ret__unsigned_long_' t = UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap (fst x) \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x)) \<longrightarrow> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x))\<rightarrow>[''tcbMCP_C''])) < UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> EXCEPTION_SYSCALL_ERROR = EXCEPTION_NONE \<longrightarrow> UCAST(32 \<rightarrow> 32) (args ! 0) \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> UCAST(32 \<rightarrow> 32) (args ! 0) = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (UCAST(32 \<rightarrow> 32) (args ! 0)))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> (\<not> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr (fst x))\<rightarrow>[''tcbMCP_C''])) < UCAST(32 \<rightarrow> 32) (args ! 0) \<longrightarrow> UCAST(32 \<rightarrow> 32) (args ! 0) \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> UCAST(32 \<rightarrow> 32) (args ! 0) = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (UCAST(32 \<rightarrow> 32) (args ! 0)))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)} \<inter> - \<lbrace>args = [] \<or> extraCaps = []\<rbrace>}}}}}}}
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xa xb. extraCaps = xa # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isThreadCap (fst xa) \<longrightarrow> tcb_at' (capTCBPtr (fst xa)) a \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst xa)) a \<longrightarrow> x \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr (fst xa)) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft2737 (option_to_ptr buffer) extraCaps' length___unsigned_long cap\<^esub> (?P'2739 (option_to_ptr buffer) extraCaps' length___unsigned_long cap) \<acute>ret__int :== (if length___unsigned_long = 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI {s. ret__int_' s = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))}
 2. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xa xb. extraCaps = xa # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isThreadCap (fst xa) \<longrightarrow> tcb_at' (capTCBPtr (fst xa)) a \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst xa)) a \<longrightarrow> x \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr (fst xa)) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))) a))) and (\<lambda>_. True)) s \<and> s' \<in> ?P'2739 buffera current_extra_caps length___unsigned_long cap \<inter> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>buffera current_extra_caps length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and valid_cap' cp and (\<lambda>y. isThreadCap cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (\<forall>xa xb. extraCaps = xa # xb \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. isThreadCap (fst xa) \<longrightarrow> tcb_at' (capTCBPtr (fst xa)) a \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr (fst xa)) a \<longrightarrow> x \<le> mask 8 \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr (fst xa)) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))) a))) and (\<lambda>_. True)) s \<and> s' \<in> {s. ((if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if length___unsigned_long = 0 then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) \<and> (\<not> (if length___unsigned_long = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))} \<inter> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> (\<forall>a b xb. extraCaps = (a, b) # xb \<longrightarrow> sysargs_rel (x # xa) buffer s \<and> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (isThreadCap a \<longrightarrow> tcb_at' (capTCBPtr a) s \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr a) s \<longrightarrow> x \<le> mask 8 \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr a) s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> excaps_in_mem ((a, b) # xb) (ctes_of s))) \<and> (length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<forall>x xa. args = x # xa \<longrightarrow> (\<forall>a b xb. extraCaps = (a, b) # xb \<longrightarrow> sysargs_rel (x # xa) buffer s \<and> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (isThreadCap a \<longrightarrow> tcb_at' (capTCBPtr a) s \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr a) s \<longrightarrow> x \<le> mask 8 \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr a) s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> excaps_in_mem ((a, b) # xb) (ctes_of s))
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xa a b xb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned a; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> sysargs_rel_n (x # xa) buffer 0 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> ((\<exists>v0. a = capability.ThreadCap v0) \<longrightarrow> tcb_at' (capTCBPtr a) s \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr a) s \<longrightarrow> x \<le> mask 8 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr a) s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xa a b xb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned a; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> ((\<exists>v0. a = capability.ThreadCap v0) \<longrightarrow> tcb_at' (capTCBPtr a) s \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr a) s \<longrightarrow> x \<le> mask 8 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> UCAST(32 \<rightarrow> 8) x \<le> maxPriority \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr a) s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xa a b xb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned a; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = a) b s\<rbrakk> \<Longrightarrow> ((\<exists>v0. a = capability.ThreadCap v0) \<longrightarrow> tcb_at' (capTCBPtr a) s \<and> (mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) (capTCBPtr a) s \<longrightarrow> x \<le> mask 8 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) (capTCBPtr a) s)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xa b xb v0a. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((capability.ThreadCap v0a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((capability.ThreadCap v0a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (capability.ThreadCap v0a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned (capability.ThreadCap v0a); tcb_at' v0a s; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.ThreadCap v0a) b s; mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) v0a s\<rbrakk> \<Longrightarrow> x \<le> mask 8 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) v0a s
 2. \<And>length___unsigned_long cap s s' v0 x xa a b xb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned a; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = a) b s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 3. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xa b xb v0a. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((capability.ThreadCap v0a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((capability.ThreadCap v0a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (capability.ThreadCap v0a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned (capability.ThreadCap v0a); tcb_at' v0a s; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.ThreadCap v0a) b s; mcpriority_tcb_at' (\<lambda>mcp. x \<le> UCAST(8 \<rightarrow> 32) mcp) v0a s; x \<le> UCAST(8 \<rightarrow> 32) (- 1)\<rbrakk> \<Longrightarrow> x \<le> mask 8 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> mcpriority_tcb_at' ((\<le>) (UCAST(32 \<rightarrow> 8) x)) v0a s
 2. \<And>length___unsigned_long cap s s' v0 x xa a b xb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned a; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = a) b s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 3. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' v0 x xa a b xb. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map ((a, b) # xb); unat length___unsigned_long = Suc (length xa); ccap_relation (capability.ThreadCap v0) cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' v0 s; sysargs_rel (x # xa) buffer s; cp = capability.ThreadCap v0; capAligned (capability.ThreadCap v0); tcb_at' v0 s; args = x # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; capAligned a; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = a) b s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; isThreadCap cp; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; valid_cap' cp s; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; sysargs_rel args buffer s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))))\<rbrakk> \<Longrightarrow> length___unsigned_long \<noteq> 0 \<longrightarrow> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = NULL then 1 else 0) = from_bool (args = [] \<or> extraCaps = []) \<longrightarrow> (\<forall>x. (\<exists>xa. args = x # xa) \<longrightarrow> (\<forall>a b. (\<exists>x. extraCaps = (a, b) # x) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = x) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> isThreadCap a \<longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < x \<longrightarrow> x \<le> mask 8 \<longrightarrow> tcb_ptr_to_ctcb_ptr (ksCurThread s) = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> x = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) x)) \<and> SCAST(32 signed \<rightarrow> 32) cap_thread_cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) xb; unat length___unsigned_long = Suc (length xa); (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) (objBits undefined); objBits undefined < word_bits; tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; length___unsigned_long \<noteq> 0; (if b = 0 then 1 else 0) = false; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; is_aligned (global.capUntypedPtr a) (capBits a); capBits a < word_bits; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. is_aligned (global.capUntypedPtr (fst v)) (capBits (fst v)) \<and> capBits (fst v) < word_bits \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); isThreadCap a\<rbrakk> \<Longrightarrow> (s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a) \<longrightarrow> \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < ret__unsigned_long_' t \<longrightarrow> ret__unsigned_long_' t \<le> mask 8 \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (ret__unsigned_long_' t))) \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) xb; unat length___unsigned_long = Suc (length xa); (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) (objBits undefined); objBits undefined < word_bits; tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; length___unsigned_long \<noteq> 0; (if b = 0 then 1 else 0) = false; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; is_aligned (global.capUntypedPtr a) (capBits a); capBits a < word_bits; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. is_aligned (global.capUntypedPtr (fst v)) (capBits (fst v)) \<and> capBits (fst v) < word_bits \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); isThreadCap a; s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (capTCBPtr a); \<not> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (capTCBPtr a)\<rightarrow>[''tcbMCP_C''])) < ret__unsigned_long_' t; ret__unsigned_long_' t \<le> mask 8; \<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (ret__unsigned_long_' t))
 2. \<And>length___unsigned_long cap s s' xa a b xb t. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) xb; unat length___unsigned_long = Suc (length xa); (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem ((a, b) # xb) (ctes_of s); ex_nonz_cap_to' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap; sysargs_rel (ret__unsigned_long_' t # xa) buffer s; ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); cp = capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))); is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) (objBits undefined); objBits undefined < word_bits; tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)))) s; length___unsigned_long \<noteq> 0; (if b = 0 then 1 else 0) = false; args = ret__unsigned_long_' t # xa; extraCaps = (a, b) # xb; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set xb. ex_cte_cap_wp_to' isCNodeCap (snd v) s; is_aligned (global.capUntypedPtr a) (capBits a); capBits a < word_bits; case a of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True; cte_wp_at' (\<lambda>_. True) b s; \<forall>v\<in>set xb. is_aligned (global.capUntypedPtr (fst v)) (capBits (fst v)) \<and> capBits (fst v) < word_bits \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); isThreadCap a\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap proof (prove)
goal:
No subgoals!